What percentage of CVEs are actually exploited?

That figure is the entire argument for risk-based prioritisation. If fewer than one CVE in two hundred is ever confirmed as exploited, then treating severity as the queue order guarantees you spend most of your effort on vulnerabilities nobody will ever use against you.

The number is a floor, not a ceiling: KEV records exploitation that has been observed and reported publicly. Real exploitation is certainly higher, and absence from the catalog is not evidence of safety.

Used properly, it inverts the question. Instead of "which of these thousands is worst?", ask "which of these has anyone actually attacked?" — a list short enough to act on the same week.