It’s possible that it was exploited before the issue was widely discovered, right? I thought it had been in there for a while.

It's entirely possible and it's still so early that we're still guessing. But so far some companies have come out to say that they've seen exploitation only as early as a few weeks ago.

Companies likely only started IR in the last week. Breach notifications, which only a minority of companies will bother to send out, will be a few weeks away at the earliest.

IIRC Cloudflare said the earliest they had seen this being exploited in the wild was very early December, but the volume went up after Friday.