It’s possible that no hackers ever discovered the bug and exploited it in two years, but anyone who counts on that assumption to be true is an idiot.