It's only for the first connection, and it's very rare that targets are valuable on the first connection. On the other hand, we know of at least two suppliers

It's only for the first connection, and it's very rare that targets are valuable on the first connection. On the other hand, we know of at least two suppliers of software that run with elevated access everywhere (including the dev side of every advanced military) that have been breached by unknown parties for years. The most likely explanation, by far, is that the sky only didn't fall yet because nobody wants it to. And that leaves us vulnerable to somebody suddenly wanting it.