The Risk, Vulnerability, Impact are calculated bit differently.
Usually, weak authentication mechanism is not a vulnerability, but a risk. In the scenario that you've described, the Impact of someone gaining access (qualitative analysis) is critical (catastrophic, severe, etc.). But the occurence is low (obscurity, no known vulnerabilities in the ...
If I am using one a VPN Service, but it allows up to lets say 8
devices to connect, are all the devices/users able to view traffic
from other users/devices?
That depends on VPN server settings, but usually yes. The connection between a client(s) and server are encrypted, but the subnet in which clients are usually not (but again, it depends on vpn ...
Although you may be using the same credentials for each device, each device will have to set up and maintain a unique tunnel and will have a different IV for each tunnel.
From server's point of view, you're simply accepting up to 8 different concurrent connections (IP:Port pairs) for the same identifier, be it an username or a ...
I personally like https://testssl.sh/, will check a lot of things and is just one script that manages all issues. If you have a look to the documentation (https://github.com/drwetter/testssl.sh/blob/3.1dev/doc/testssl.1.md) on the section "Basic parameters" you can find a full description of how to manage the ports.