Also by that measure we're never safe. Which is fine, I think we can agree there are almost always unknown exploits out there but that's not the discussion.
There is more nuance to this as well, it might work, but only in certain circumstances which seems to be where this is going at the moment.
The point is you that the criteria for "am I safe from this vulnerability" is "I have applied the patches and/or config changes recommended by the author of the software" and not "I tried to run the PoC against my system and it didn't work". (nor, as was common in this case, "I have applied some config changes that some random people online feel like should help")
It's memory corruption. That requires some guesswork or understanding of the underlying system (platform + ABI) and heap grooming to actually exploit but that's not a security boundary. Any vulnerable version is just going to get hammered with requests until it either crashes without an exploit or actually gets popped.