So, the affected function, in includes/vb5/frontend/controller/bbcode.php was:

    function evalCode($code) {
        ob_start();
        eval($code);
        $output = ob_get_contents();
        ob_end_clean();
        return $output;
    }

... So anyone who looks at a codebase for eval would have found this. There is no doubt in my mind that when some people have claimed that this has been around for years... That it has definitely been around for years.

And as the fix is:

    // comment out. idk what it breaks but it's a fix for now
    //eval($code);

I don't think anyone even knows what the hell that eval was doing there in the first place.