This is survivor bias because bad guys that suck are ignored as "noise". There is a ton of very low-tech outdated vulnerability scanning going on that is not at all current.