Finding vulnerabilities and thus fixing them is a good thing. At least with Linux we know what is happening.

You are correct this is the one mounted on /tmp.

Everything under /run and /dev is normal to be on tmpfs and should not be changed.

In Linux, a lot of internal systems and devices are considered as files even if they are not really a file in the usual sense of it. For example what is in /dev is usually not really taking up RAM space but more of a representation of the devices (internal and external) that are attached to your system. You can programatically read and write to these “files” to communicate with the devices.