everyone says prompt injection is a huge deal but is it actually exploitable in production

Every security paper acts like prompt injection is this massive vulnerability but I haven't seen any real examples of someone actually exploiting it in a production app to do something bad. Like yeah you can make it say weird stuff in a demo but does that actually matter? has anyone seen a real exploit that caused actual damage or is this just academic fear mongering