A quote-tweet of https://news.ycombinator.com/item?id=36696127 showing that the vulnerabilities used in the picture were actually patched, but targeted enterprise users were on an update channel without these patches.