In reply to Ryan Hellyer.

Yes, the file was their intentionally, and its usage as such in core established doing so as a "best practice".

The entire genericons package has been included with all of the bundled themes since Twenty Thirteen, since WordPress 3.8. Specifically, this practice was introduced in this ticket: https://core.trac.wordpress.org/ticket/25085#comment:16. The goal was to make it easier to update the genericons package when updates were released, as well as to make its handling more consistent across the different themes. However, since the vulnerability was introduced in a newer version of genericons that is in Twenty Fifteen but hasn't yet been bundled with Twenty Thirteen or Fourteen, the root cause of the example.html file's presence was somewhat less clear.

Bottom line, the issue was with Genericons itself, and everyone did a great job of addressing the issue in all of the widely distributed places that it's bundled despite the timeline issues.