I have to wonder, what is the real substantive number difference in exploits. Its in the hype train's interest to pump the CVEs in both quantity and severity so I do wonder how much of that is happening.

The time to exploit is also somewhat hypothetical. We're assuming infinite attacker resources which hasn't really been the assumption.

We see a lot more news and fear but are we seeing more actual "large scale exploitation"?

I'd love to see some numbers in that regard.