I don't think it's a vulnerability. When you think about it as a password sent in plaintext, then yes it's understandable to think there's a vulnerability here, but it's not a password.
Sending you a link like
https://example.com/reset.php?code=97fy978y39fny39478fyn3 which is a one-time link that you click to be taken to a password reset form in which you type your new password, is essentially the same as sending you a one-time password, they just took the
code from the link and called it a temporary password.
The idea itself isn't vulnerable, but the incorrect implementation mostly is.
What could go wrong here?
code or the password could be very short and/or no generated with a cryptographically secure PRNG.
code or the password could give access to areas of the account for an extended period of time before setting a new password.
code or the password could stay valid for a long time, making their eventual exposure a risk.
Not using HTTPS, which gives a MitM a chance to intercept them.
Update: You're correct, email is outside the scope of the implementation, but then we'd go completely off-topic. We can discuss that the whole system is broken, but there's no other option. They could send you the code in an SMS, but what if your friend was holding your mobile? They could send it to your mailbox (kind of silly) but what if somebody opened your mailbox? The only secure option left is that they send a representative of the company to go to your address and ask you for your ID and take your fingerprints (which you've given on the registration form) and then reset your password.
You see, the email is de facto way to contact the original account owner, so that's the best they can do.
All in all, I was just trying to show you that the security of the plaintext one-time password is exactly the same as the one-time link used by almost all web services (Facebook, Twitter, StackExchange, ...)