The bug was patched within days, but developers acknowledged there's still no way to prove it was never exploited before the fix