So... I'm noticing something about the thaumaturge, and Charisma.
The Charisma thaumaturge is a very specific type - it's the idea of someone who maybe knows a bunhc of stuff about the enemy and their weaknesses, but who also has this sort of weird force-of-personality thing that lets him force through a weakness even where none exists, or make his idea of a weakness work even when he gets it wrong. It's sort of a UMD-based concept of charisma, but it makes a degree of sense.
But is that the only kind of thaumaturge we might see?
Intelligence-based seems like an obvious one - more core to the class than Charisma, really. The whole idea of the Thaumaturge is that it's someone who knows lots and lots of stuff about the enemy, and is crazy-prepared all the time. That's a lot more Int than it is Cha. It might take a bit of a trick to justify hitting a vulnerability when there is no vulnerability to hit, but you could perhaps cover that with a bit of an arcane flavor? Like, with the right invocation, your implements can grant you the effect of a "Bane: that guy over there" rune, once you know them well enough to describe them sufficiently for the invocation.
Wisdom-based is also pretty compelling. In particular, the Thaumaturge eats a bit of the Inquisitor's lunch, and it wouldn't take all that much more to get the whole thing. It seems like if you give them a wisdom-based version (powered largely by relics, faith, and prayers to very specific saints/angels/etc out of the deep apocrypha for aid against this particular foe) and a pact to something divine/celestial, you'd pretty much have it covered.
It wouldn't have to be a particularly deep subtyping - Thaumaturges get their deep subtyping from their implements. It'd be more on the level of Unconscious Mind - flavorful, adjusts the statline, maybe the equivalent of a feat or two worth of change to capabilities, but overall more important for the fluff than the crunch. It would mean that we'd have one version that was pure occult, one that was a sort of occult/divine hybrid, and one that was a sort of occult/arcane hybrid, but... no one's throwing around any spells based on this anyway, so you can blur the lines a bit more than normal, and it's okay.
It might take a bit of a trick to justify hitting a vulnerability when there is no vulnerability to hit, but you could perhaps cover that with a bit of an arcane flavor?I actually think you don't even need this. In the original Dracula, Van Helsing just spouts a bunch of weaknesses for Dracula. Some of them make as much sense as the suggestions we've seen for making them up with Cha. I think it could just be flavored as having read the one particular book where that one weakness was referenced for that one monster. It's just that no one else knows about it.
Okay... but what if the monster you're targeting is, say, an Orc? Or a peasant? Harder to justify weird edge-case vulnerabilities in that case, as those things would already be known as poisons, lethal threats, or whatever. It's not enough to say that you know just where to hit them, because that's the rogue precision damage schtick, and that's not what's going on here.
"According to Alma's studies on the Inherent Magic of the Classes, jewelry from their nobility, when amplified, can burn a peasant. The source is uncertain, probably to stop robberies. But it should be just as effective here."
I don't know, something like that maybe?
The difference there is "when amplified". Sure it works. Taking weird resonances and amplifying them is exactly what the charisma-based version does. How is your int-based character doing the amplifying?
I figure, dipping into the arcane side of the fluff a bit for a few invocations and general-purpose tunable runes explains it pretty well. It's arcane because you need the academic understanding of arcane principles to get the runes and the invocations to work in the first place, and it's occult because you still need the weird encyclopedic grasp of strange resonances to know what to tune them for.