The crucial piece of my statement and my question is that such an exploit doesn't have to be on GitHub to exist.
Again: such exploits are typically not distributed, hosted or published on platforms like GitHub. But on forums, boards and shops on the dark or deep web.
