> not used in the wild because the vulnerability disclosure process actually worked This mental model kind of works for thinking about widespread exploitation

> not used in the wild because the vulnerability disclosure process actually worked This mental model kind of works for thinking about widespread exploitation but of course the vulnerabilities don't materialize when they are publicized, and most exploitations aren't publicly documented even if detected.