At this point, I'm quite surprised about how rare we see ESD damages in electronics.
Many cards and chips, including CPUs, are handled like this daily in computer stores and repair shops, without any precautions (though, I've checked the transparent packages that originally come with RAM and CPUs, they're indeed ESD-safe, but any packages in secondary markets are suspects). I had received a 10 Gigabit Ethernet card in many layers of bubble wraps, it still works. We also see popular development boards like Arduino or Raspberry Pi with zero ESD protections on GPIOs, the I/Os go straight into the ASIC, and many boards are carelessly handled by hobbyists, yet most still work

(myself included, I once physically touched the SoC on a Pi while explaining the danger of ESD - it instantly crashed, but continued to work after power cycling).
My conclusions are that engineering-level ESD tests and controls are meant to be 100% repeatable and rigorous, the IEC 61000-4-2 is quite a strict test, but even a pretty loose and weak 2 kV human-body model is still a real engineering test under laboratory conditions.
In real life, if you allow a factor of uncontrolled luckiness, the "ESD passing rate" goes up. In addition, a fully-assembled board is probably less likely to be damaged by ESD because there are many components on the board to absorb the energy, especially the decoupling capacitors in the power supply. Also, ESD damages can be latent failures that are not tolerated in production, but in practice at user's side, these failures may never even show up if the component is not operated at the extremes of their ratings - who cares if the on-chip ESD diodes on an interface become slightly leaky?