What describes the difference when comparing attack surface and vulnerability in practice?

Updating the OS reduces the attack surface, and installing separate optional patches remediates and solves vulnerabilities within the system.

Patching SMB vulnerability is an attack surface reduction, and the open unused ports are the vulnerabilities within the system.

A SMB server that can allow remote code execution is a vulnerability, and closing port 139 is an attack surface reduction.

The attack surface is the SQL injection targeted on the database, and the database tables are the vulnerabilities that might be exploited.