We have found no evidence of malicious actors abusing this vector"
"We see no evidence of that which we do not monitor."
These press releases/responses seem to never include "we track x and y and see no evidence". Or "we would be able to identify them but do not see evidence". I can only assume the worst.