Particular frameworks, CMSes, blog systems and other widely-installed web apps are targeted all the time. When examining web server access logs, it's quite com

Particular frameworks, CMSes, blog systems and other widely-installed web apps are targeted all the time. When examining web server access logs, it's quite common to see hundreds of requests coming in from a single host during a short period of time, looking to see if certain exploitable framework- or app-specific pages exist. Such scanners do appear to target certain frameworks or web apps, contrary to your suggestion that this does not happen.