It was actually found less than two months after it was introduced in 5.6.0. Now, the attacker maintained the project for 2 years before that, and we don't know

It was actually found less than two months after it was introduced in 5.6.0. Now, the attacker maintained the project for 2 years before that, and we don't know what else they inserted, but the known vulnerability was only in a release since February.