Law 3: If a bad guy has unrestricted physical access to your computer, it's not your computer anymore.
It's a security risk, yes, but refer to this rule and read the link I posted. Actually, it'd be good to read that rule (Law 3) in addition to the rest of the Immutable Laws.
I'm not sure your question, "Are all OSes vulnerable to local password reset attacks" is within the scope of what we can answer; for instance, some popular operating systems might be, but perhaps there are a handful somewhere that aren't.
Passwords are sort of like locks. Locking your door might prevent a crime of opportunity, but it certainly won't deter a determined criminal. That's why you don't leave valuables in plain sight and you install an alarm system.
Think about it -- you can boot from a USB and read the data on the hard drive. That's a very possible attack vector. It accomplishes pretty much the same thing, yet saves them from having to go through the trouble of resetting the root/admin password. So, really, it's helpful for people who forget the root password, and isn't too much of an added vulnerability, because if it is an issue for you, then you have bigger issues in the first place (somebody with physical access to your machine's unencrypted data).