Apple and Google regularly tell the media they haven't seen exploits of a specific vulnerability or exploits of devices with a security protection enabled. This is heavily misinterpreted as meaning exploits aren't happening. They don't ever find out about many successful attacks.