Because no one is looking

Assume == ass u me

shit entropy is a vulnerability, but you usually can't just do a search for "keys with bad entropy". In the CC case, being aware of the bug was a pre requisite, because the attacker needs to be able to identify the target search space, which is only possible if he knows the (pseudo random) key gene...