Perhaps "has it ever been hacked" is not the best metric, unless you prefer to keep your devices under armed guard, encased in several meters of concrete, without an internet connection.

IMO, https://zerodium.com/program.html is a good indication of "what would it cost to hack me using a never-before-seen exploit".

You wrongly assumed that zero days are single-use. Pegasus used the same exploits in dozens or hundreds of targets.

I didn't assume that at all - that's why I specified a never-before-seen vulnerability.

"seen" could not be true until after thousands are hacked.

Still surprising to me that AWS has firecracker and iOS still runs things like Javascript along side every other app on the system.