The loan is rarely the vulnerability; it is the amplifier. The exploit is usually a price read from a shallow pool, a share-price formula that can be unbalanced, or a governance system where voting power is measured at the moment of the vote rather than at an earlier snapshot.
A typical sequence: borrow a large sum, swap it to crush one side of a thin pool, use the distorted price to borrow far more than the collateral is worth from a protocol reading that pool, repay the flash loan, and leave with the difference. All of it settles in one transaction, so there is no window to intervene.
Mitigations are well understood: aggregate price feeds, use twap-oracle windows, snapshot governance balances in an earlier block, and cap per-block changes. When assessing a protocol, ask specifically what a caller with unlimited one-block capital could do to each formula it relies on.
Related: flash-loan, oracle-manipulation, governance-quorum, smart-contract-audit