But we're not observing people for 3 months and picking an arbitrary two week window. People do not get added to the population until they have taken the vaccine, and they are all observed for different lengths of time. We did not hypothesize a 2 week period beforehand and compare how many landed within to how many were outside that range, the 2 weeks is just a circle drawn around the datapoints after the fact.

Here is the chain of logic:

1. First assume independence, that CVST is unrelated to vaccination.

2. Take any two weeks, you can calculate the expected cases using population background rate because we assume independence.

3. The number is around 1 using Wikipedia data.

4. The observed case number 6 greatly exceeds the expected number based on independence assumption.

5. We conclude that with high probability that our independence assumption is wrong, i.e. there's correlation with high confidence.

Your logic breaks down at step 2. As a counter example, what are the odds that in the other 7 weeks you would have zero cases? Of course the answer is that this isn't how the data works.

You are not sampling a random, normally distributed event over a fixed interval, you are sampling the spacing between two different events where one of them is systemically linked to how you define the population and the interval.