Since other people are reporting that their copies of bash 3.2.51 are vulnerable, I suspect that the version of bash that is currently running in that terminal is 3.2.51 and vulnerable, but the version of bash that you are invoking from that vulnerable version of bash is not.

In other words, I suspect that:

    $ echo $BASH_VERSION

and

    $ bash --version

Will report different version numbers.

If you start a new terminal and try `echo $BASH_VERSION`, you will probably see a different version as well.