Not a Modbus _exploit_
It sounds to me like the exploit was the Microtik router that then allowed the attackers to gain access to the network being used to carry the modbus traffic.
They then mearly _used_ the modbus protocol to send fake data, but modbus was not exploited as such and there were no new vulnerbalities in it. Modbus is an insecure protocol that relies on the security of the underlying network for protection, as such it worked exactly as designed,
This was a failure of the network and or the architecture of the system