Should the security CIA triad be the... uhhhh, CI line?

There's been a pretty big discussion going on over at the Matasano Chargen blog about whether or not availability problems are properly classified when they are referred to as security issues.  The discussion finds it's source in a recent advisory about a buffer overflow vulnerability in OpenBSD that could cause the attacked server to crash and burn.  Here's a quote from the advisory on how the OpenBSD team responded when they received the information on the vulnerability:

2007-02-26: OpenBSD team communicates that the issue is specific to OpenBSD. OpenBSD no longer uses the term "vulnerability" when referring to bugs that lead to a remote denial of service attack, as opposed to bugs that lead to remote control of vulnerable systems to avoid oversimplifying ("pablumfication") the use of the term.

The old school security guy in me wants to push up my sleeves and hold up my fists at such heresy.  Just because a bug does not lead to remote code execution does not mean it is not a security issue.  There are too many problems that can be caused by shutting down a system.  Often this type of attack is merely used as a distraction or possibly a way of entry to attack other systems.  If you are running an OpenBSD security appliance, doesn't an availability vulnerability turn on alarm bells?  If a company instigates a DDos at a rival to hurt their business, isn't that a security issue?  Ivan (who I assume worked on the advisory team) comments on the blog post:

We consider a remote DoS a security issue not only because it has a direct effect on availability but also because a remote DoS can be a convenient building block for a composite attack (for those lacking in creativity: think DNS).

Security should always be looked at from the risk perspective.  You can kill (almost) all risk of compromise of data by unplugging and turning off the system, locking it in a safe, and placing it behind a brick wall.  But if you need the data to conduct business, then your risk mitigation techniques are shoddy, and so your security is faulty.