Many apps (eg chrome) frequently fix bugs that are actively exploited in the wild yet have no public weaponized chain (sometimes for months).
The fact that there is no fully public weaponized chain does not mean it does not exist or that this bug is not as scary. It only means that it is not as trivial to exploit as log4shell/shellshock/etc.
According to cloudflare [1], it is being exploited in the wild.
*My phone autocorrected to that and I'm keeping it.
Where are the mass successful exploits? Why is this different to any other patch?
That is people trying to exploit it, not that it is being exploited in the wild. They could've all failed because its not easily exploitable, like the post said.
Penalty is based on the impact, and while even attempts can have significant impact, software systems are non-feeling entities that endure attempted exploitation all the time. Just check your logs if you run any public service.