I would not expect anyone to be on the lookout continuously, but like the researcher doing a "yolo" and trying. There are enough people out there that it is likely to happen at least once in a while. Or for instance someone looking for a firmware exploit in a downstream device.

And here you learn why security is often just theater (not saying a proper elliptic key is theater)...

It took less than a second to factor this key. Why not attempt, say, to factor every CA, with a budget of less than a minute each?

The reward/risk ratio is skewed so heavily in favor of trying, the only reason not to is this idea that it is "impossible".

It's clearly not, hence, the theater. Your locks don't have to work, they often only have to look like they work...

Factoring is for RSA. The best non-quantum attack against ECDSA is meet-in-the-middle brute force, with sqrt complexity. With RSA you can check if any keys in the world have any low factors and that might be interesting to do, even if you don't get any complete keys. With ECDSA the search is all or nothing and without an obvious starting point.