Those vulnerabilities really have nothing to do with the PDF/A question. PDF signature validators have to check for them regardless of PDF/A, and the issue I raised above is independent of those vulnerabilities.