They have to code the malicious software, though. Depends on the individual CVE, most of them are theoretical and few attackers bother creating an exploit when patches are already being rolled out. The exploits that have been made have long since been taken offline in exchange for expliots which target much newer systems. I guarantee you no one is sifting through ancient CVEs thinking "oh look, here's something for iOS 6, let me spend time crafting an exploit which won't see a single device and bring me in zero dollars"
Are you claiming that OP's iOS 6 device is publicly exposed to the internet, and is not behind a router?
What does that even mean?
That's literally what you're arguing for. You're claiming someone is going out of their way to find an exploit for iOS 6, then find and target iOS 6 devices.
They're portscanning the internet for unpatched versions of ssh or windows XP running on publicly-accessible servers. In order to exploit the iOS 6 device, they'd have to craft a website OP wants to visit, craft the exploit itself, then manage to get it in front of them. Why would they bother with that when they can just craft yet another "microsofts have deteccted the viurs on your PC!!!1! call the number below to talk to microsoft certifed professsional" and get 100,000,000x more hits, 10,000,000x more victims, and make infinitely more money with basically no advanced skills?