Most likely this was discovered sooner. But people kept the vulnerability to themselves and possibly even profited from it.

These kind of vulnerabilities in high-profile sites can go unreported for ages, even up to the point that they are common knowledge in certain groups.