This suffers from the same flaws as most CVE statistics. You take some data that you have, assume it's a representative sample and then make some claims based o

This suffers from the same flaws as most CVE statistics. You take some data that you have, assume it's a representative sample and then make some claims based on it. The problem is: It's not a representative sample. If I understand this correct this is looking at CVEs where exploitation has happened as announced by the vendor. It's bad statistics, because you cannot assume all vendors tread these things equally (one vendor may be very open about known exploitations while another may try to hide stuff as much as possible). Creating such statistics also creates an incentive for vendors to be more secretive if such things happen, so it's not just bad statistics, it's also bad for security.