It was noticed by some vendors. They just didn't know what it was. Mikrotik, for example, posted a warning on their forums months ago, when their users noticed

It was noticed by some vendors. They just didn't know what it was. Mikrotik, for example, posted a warning on their forums months ago, when their users noticed a sudden uptick in attempt to get at ports 80 and 8291. In this case the attack was scanning for the existence of port 8291 to identify these routers, and then attempting an exploit on port 80. It was only months later that we all learned the VPNFilter was the culprit.