> On Dec 24th, MongoDB reported they have no evidence of anybody exploiting the CVE

Absence of evidence is not evidence of absence...