Are you measuring in binary or probability?

In binary any security flaw you've written is a risk the moment it's put to use. So, yea it's a real risk.

In probability measures it's much more difficult to figure out. If your application is something big that everyone uses and has high stakes then the probability is always high even for things that would be pretty hard to trigger. For example who knows how many nation states were sitting on postgres bugs for years? For smaller more private software AI has increased the risk greatly.

Either way it's irrelevant in my eyes. There was always going to be a day of reckoning in the future. Some new technology was always destiny to show up and rain on our lack of security parade.