It's not a vulnerability, but it's an exploit. Most vulnerabilities in the wild never have an exploit written, because we mostly assume that for example arbitrary write or buffer overflow are dangerous and "can lead to arbitrary code execution", but actually exploiting them is hard.
This is someone who spend some time to write something to actually exploit sites with this vulnerability.
The Marshal.load docs explicitly have a warning that you should not pass it untrusted data: https://docs.ruby-lang.org/en/master/Marshal.html#module-mar...