"Exceptions are values within the system’s expected operating boundaries." This makes sense in narrow context, but as a question of intent - exceptions are not expected. Common example I encounter in prod are .net platform libraries which add security exceptions on system update w/o requiring app rebuilds.
Yes, exceptions often surprise us in practice. The distinction I'm drawing is more about categorical boundaries than anticipated boundaries: exceptions are part of normal control flow, they are catchable and can be handled. Assertion violations are different: if an invariant is violated, no subsequent action should be trusted.