Your first point lacks context of the next paragraph. Here’s the two paragraphs combined which changes the meaning. >The fact is, if we accept Marriott’s state

Your first point lacks context of the next paragraph. Here’s the two paragraphs combined which changes the meaning. >The fact is, if we accept Marriott’s statement that the breach began in 2014, the system would already have been operating securely for five years. >It is difficult to imagine how an architectural or platform vulnerability would not have been discovered or exploited sooner. He’s saying it’s most likely this exploit has been discovered earlier than 2014. This is even more aggressive than your point which was >>It does not mean that. It means that we don't know of any exploited vulnerabilities before that point.