CRB checks have now been replaced by DBS checks.
>>>to which she replied "everybody over 18 is now considered vulnerable"
WRONG! No employer (or voluntary organisation) can carry out a DBS check on an employee unless the work (or voluntary activity) falls within one of the categories listed within the Annex to this document:
https://www.gov.uk/government/uploads/system/uploads/attachment_data/file/409805/DBS_guide_eligibility_v7.pdf
(In Scotland a more basic level of check, which doesn't show spent convictions, is available to ALL employers but, as you're in the south of England, it's not relevant here).
While the Secretary of State for Education places a requirement upon schools to carry out DBS checks on all
school staff who have regular contact with children, it's accepted that it would not be practical for schools to have DBS checks carried out on all adults that young people might encounter during work experience programmes. (As someone who's spent hundreds of hours trying to persuade employers to take school students on work experience, I can tell you that such schemes simply couldn't exist if an extra strand of red tape was applied to them). Schools simply have to take 'reasonable measures' to ensure the safety and well-being of their pupils on work experience schemes.
So you do NOT require a DBS check.