This is weird: I have only bullseye/bullseye-updates/bullseye-security in my sources list. I applied all updates on 2nd of May with no Exim package available. Then after the 21nails disclosure I run the updates (timestamps in UTC):
2021-05-02 07:05:31 status installed initramfs-tools:all 0.140 ... 2021-05-04 16:49:48 upgrade exim4-daemon-light:amd64 4.94-17 4.94-19 But there is no transaction for 4.94-19 in PTS between these two dates, next is [2021-05-05] exim4 4.94-19 MIGRATED to testing (Debian testing watch)