It's kind of similar to finding a trivial security bug in a critical piece of software after a decade of it being introduced into code. You would think it would

It's kind of similar to finding a trivial security bug in a critical piece of software after a decade of it being introduced into code. You would think it would not be possible because the software is being used everywhere for extremely important stuff, and so many highly-skilled security researchers would have already looked out for it due to incentives. But there are many examples of this happening. I have heard of many instances where a critical security bug was already reported many years ago, but no one bothered to look at it and fix it until someone else rediscovered it.