It requires skilled security researchers to unearth this?
<?xml version="1.0" encoding="UTF-8"?> <bang type="yaml">--- !ruby/object:Time {} </bang>
<?xml version="1.0" encoding="UTF-8"?> <bang type="yaml">--- !ruby/object:Time {} </bang>
An exploit that's simple to use does not mean that it was simple to discover. In fact, the opposite is often the case.