There are a few flaws with your reasoning.
or example, internet accessible admin portal which even though still requires authentication, it doesn't have IP whitelist nor 2FA.
Consider for a moment why IP whitelisting was ever recommended or why 2FA is being pushed so heavily these days (despite some flaws) if plain authentication is "good enough" to not be a threat. The alternative to plain authentication is nothing, which is not a vulnerability, it's absolute negligence.
I would say it's not vulnerability since one needs valid credentials to actually be able to use the portal.
It's similar to having a gun (admin portal) without bullets (credentials). It's only dangerous if you somehow manage to get bullets.
A gun is only dangerous if it has bullets? That sort of thinking does not instill me with confidence that you should ever own one.
- An unloaded firearm can still be used to rob the liquor store.
- Children wielding toy replicas have been killed by police.
- Many actors have been killed by prop guns loaded with blanks.
Bullets were absent in each of those scenarios. The presence of the gun itself is the threat-- bullets are just an amplifying factor, which is why the courts don't care whether or not you possessed bullets when you commit armed robbery or evasion. All that matters is that a gun--or something that looked like one--was involved in the commission of the crime.
(Possession of bullets becomes more of a consideration in manslaughter/murder cases when assessing intent. Hard to claim someone intended to kill when they were caught with an unloaded firearm. But most computer crimes are about some form of theft.)
Same goes for things like chlorine, ammonia, solvents or gasoline. Just because they only become an immediate danger when combined with each other or a source of ignition does not mean they are "not threats" in isolation.
Nuclear waste is a better analogy. If you're going to produce it, you'd better figure out how to safely handle it-- because the only way it is not a threat is if you don't create it in the first place.
I guess here, the impact is high but the likelihood would be in relation to how easy is for someone to acquire valid credentials, which in most cases should be very low)
This is also naive. Your scenario here is abstract, but in my professional experience--at an enterprise level, where people should know better--I've seen service accounts with passwords in the common 1000 list or are derived from the company name. User accounts are seldom better.
Can you unerringly account for the fact that your sysadmin is not using the same password for his Grindr account as he is for your production systems?
Besides, knowing the credentials themselves isn't always necessary. You said this is a web portal-- hijacking the session(s) of a user with valid credentials would work just as well and be much easier to pull off.
You can't just assume the risk of credential compromise is low because your users are presumed to be intelligent and do everything right. Even when they are, sometimes things happen that are beyond even their knowledge or control.
An admin portal should be accessible only to administrative users from within the network of the administrating entity. How those controls are implemented is an exercise for that entity but in exposing such an endpoint to the public internet, you are inviting a very different user demographic. It is still a threat in both cases, less so in the former, but in the end splitting hairs over whether this is or is not a threat is arguing semantics and distracts from the real issue.
Your admin portal is an endpoint that can be traversed any number of ways to allow god-tier access to your application. Repeat that to yourself a few times until the implications of it sink in. The fact that it exists at all is a threat. The best you can do is lessen how much of a threat it is by putting up as many roadblocks to unauthorized access as you are willing to support.