We should probably introduce a simple version of hardware vulnerabilities that attach to the System asset.
One concern is if and how we want to the unsafe user actions to trigger hardware vulnerabilities. Also, currently unsafe user action on the System asset does not lead to physical access for the vulnerabilities on the Applications running on that System. I chose to implement it this way because I felt it was too broad to have the user trigger hardware flaws, but often the physical access requirement for SoftwareVulnerabilities refers to much more limited unsafe behaviour.