Instances running 18.2 should be fine, and as far as I understand it (with no dev qualifications to speak of, fwiw), these exploits only affected the local instance - they weren’t permeating through other instances viewing the exploits through Activitypub. That’s all to say, as long as your instance is running 18.2 or higher (the 18.2-rc’s should have in progress patches, as well), I believe you should be fine.
Was working retail in an area that had a local bag ordinance that required businesses to charge customers for bags. A man came up to the register and when I asked him if he wanted a bag for a few cents extra, he looked at me like I was crazy and was like, “You charge for bags?” I explained that it was required by the government and he just kinda scoffed. I thought that was it, but as he opened his wallet to pay, he flashed what turned out to be a police badge at me from another city some ways away, gave me a look, and said something along the lines of “I think I know what the law is.” I just finished up the transaction and got him going asap, blown away at the insecurity displayed. It was such a bizarre powermove over what was only a few cents extra for something completely optional.