It is called a "zero-day" because the programmer has had zero days to fix the flaw (in other words, a patch is not available).[0]
Personally, I've noticed more use of "zero-day" to mean "exploits are now public but no patch is yet available" than to mean literally "programmers just learned of the bug today".