But just because there isn't a working PoC on GitHub doesn't mean there isn't one and things aren't been actively exploited.

If you are a bad actor you probably don't share your PoC around as it means less boxes to hit.

You can never rule out the possibility that someone interested in attacking you has a non-public exploit, but it's dramatically less likely if there aren't already working exploits circulating all over the internet.