Others did get hacked, or are vulnerable to it, but aren’t big enough targets?

Beehaw is closed, so they would have had to have an existing account to exploit the same bug (or go through something like Kbin), and Lemmy.world is the biggest Lemmy instance.