If this can happen, does this not make the PKI vulnerable?
if by chance they tend to generate THE SAME key (p,q) and private parameter (d), indeed they could read/sign each other's messages
However - it is the same probability as with guessing any key - choosing a random value from the whole set, there's a small probability the chosen value will be the key. The keyspace (say 128 bit for symmetric / 2048 bit for assymetric keys) should be big enough that the probability is negligible.
Now A has the PuKey of X which also happens to be the PuKey/PrKey of Y
A shall have no access to the private key of Y. As it happens, that's not problem of PKI, that's problem of Y not protecting its key