How is this not a glaring security vulnerability?
It is. Physical access to your system is the ultimate vulnerability.
Is there a way to disable this 'feature' so that it cannot be changed from GRUB like this?
Can you do this in all other Linux distros as well? Or is this a Redhat exclusive ability?
Make yourself aware of what is happening here:
Your operating system is not even running yet when the attacker takes control of your system.
While GRUB comes packaged with Linux, it's not an integral part of it, and actually, the attacker could replace GRUB with some other bootloader without the OS being any the wiser.
So it's not as much about your OS being vulnerable. It's about your OS, any OS really, having been taken out of the equation.
Even if you have your hard drive encrypted, requiring the user to enter the password before the actual boot. With physical access to your system, nothing keeps the attacker from e.g. installing a keylogger (hardware or software) to get that password the next time it is entered.
Since there is virtually no way to defend against an attacker with physical access to your machine, generic operating systems don't bother with making it hard(er) for an attacker with such priviledges. You've already lost the fight at this point.
Someone with physical access is, effectively, a root user.