It needs the target to accept and open a file, so it is not a zero-click attack, and there is no sign it has been used against anyone. It still matters for people who rely on Lockdown Mode: persistence across an update means patching alone may not clean a device that was already compromised.

For high-risk users: set AirDrop to Contacts Only or Receiving Off, don't accept files from unknown senders, and if you suspect compromise, restore the device rather than just updating it.