True, it's a theory; basically a hypothesis derived from my experience with LLMs and their performance in CTFs/finding and exploiting vulnerabilities. Plausible, I believe, but I don't have any hard evidence of it happening.

Maybe the effort and required hardware of running an LLM locally have so far prevented widespread exploitation? Maybe open-weight LLMs are too far behind at the moment? Maybe it's happening but we didn't notice it for some reason?

I would strongly assume that it will happen at some point if it isn't already.