> when a single collision has yet to be produced

No collisions published to the public doesn't mean no collisions have been found.

As the article says; “we should assume that the worst vulnerabilities go undisclosed.”