Perhaps they moved fast:
"Mozilla is aware of websites exploiting this vulnerability already."
"Mozilla is aware of websites exploiting this vulnerability already."
Clearly the vulnerabilities are exploitable as demonstrated by Manfred Paul's winning Pwn2Own entry. The details were disclosed only to Zero Day Initiative staff (the contest organizers) and Mozilla. They have not been discovered on any website in the wild.
Although the two patches have now been public for ~6 days at this point.
Also, they've specifically called that out in the advisory when they're aware of that being the case. See the last out-of-band security update they released for example:
https://www.mozilla.org/en-US/security/advisories/mfsa2022-0...