But it doesn't have to be a zero day if it's never getting patched at this point. It could be a 400 day that acts like a zero day - even more dangerous due to the potential for more threat actors to know about it and using the exploit doesn't burn it.