The only vulnerabilities excluded from the known ones are those that are not discovered yet... And they are a bit hard to ask questions about. So yeah, I agree that the tags are confusing and not very useful.
I suspect that the purpose of known-vulnerability was for question about how to systematically deal with known vulnerabilities in an organization, as opposed to how to deal with one specific vulnerability. But that is not how the tag is used, and there is a much better tag for that: vulnerability-management. (Perhaps one might first want to do a quick scroll through to find questions to retag with before doing a merge.)
But still... I am not sure I even like the vulnerability tag. I don't understand what questions are not about vulnerabilities? At the very least, it is a very broad tag. I would not cry if we killed it as well... but do not let that stand in the way of improving things on the margin - so yes, I am in favor of a merge.