Just because nobody reported current versions being hacked doesn't mean this hasn't happened. WordPress is used by millions of people but we only ever hear from a very small fraction of these. Power users, especially those who understand risks and know how to take remedial action, don't go to forums to bleat about their site(s) being exploited.

An exploit may be reported to WordPress without ever saying that the information was gathered because a site was hacked.

I had a site hacked years ago. It was running the latest WordPress of that time & after I found the exploit had been publicly reported in milw0rm I didn't bother notifying the devs.