I think the Tesla example you gave serves your point particularly well, because the researcher himself didn’t even know that there was a vulnerability until several weeks after he had placed a probe and someone in Tesla accessed an internal page.