Explain your logic? They'd attack things they know is safe? Or do you mean a safe list would narrow down the unsafe list for attackers to focus on?

It would narrow down what isn’t safe. Attack anything not mentioned.

Trouble is, we now know we're using platforms and services which aren't safe but with no idea where we're vulnerable. Ignorance is bliss. That being said, the genie is out of the bottle now and I'd hope the work is being done to mitigate all these risks as rapidly as possible.