Yes it is wild how much of the internet security has been cracked open lately but Bruno is right. If it really was as simple as they claim, bad actors would have already demolished the internet in its entirety.
The world being proposed by the claims of AI companies requires that 1. frontier models are so much better than widely-available ones at finding vulnerabilities that those "frontier CVEs" carry unique risk; 2. they successfully kept anyone with bad intentions from touching those models ever