We have found no evidence of malicious actors abusing this vector"

"We see no evidence of that which we do not monitor."

These press releases/responses seem to never include "we track x and y and see no evidence". Or "we would be able to identify them but do not see evidence". I can only assume the worst.