Well vulnerabilities may still exist, but they may not be with the OS.  There may be a 3rd party app running on the device that has vulns such as Adobe Reader or java.  you won't get that information from a frontal scan of the device.  These may be assumptions and yes your only way to tell is if you send them a crafted phishing email with an infected attachment or link.  Again you will still need to exploit something.  And even though your initial scan comes up empty, vulns still may exist but other controls are in place to prevent the information from being known.

Ways to get the information on what software they might be running could involve some social engineering attempts (unless that is listed as out-of-scope on the engagement docs).