I always thought it was like "patient 0". The day-counting started once the exploit was first exploited, meaning the first to exploit it was doing so on the 0th day.