Oldstyle numbers are currently (version 0.7) located in the Corporate Use area. They should, as I understand it, be located in the unencoded space of the font. The reason is that a pdf with oldstyle numbers otherwise won't be able to "convert" those numbers back to regular numbers. The result is that you can't search for numbers in the pdf, nor can you copy them from the pdf and get numbers when you paste them in another document. Please look at a font like EB-Garamond to see how it can/should be done. The following XeLaTeX document will illustrate this. Try to copy and paste the numbers out of the pdf file, and you will only get boxes.
\documentclass{article}
\usepackage{fontspec}
\setmainfont[Numbers = OldStyle]{CMU Serif}
\begin{document}
1234567890
\end{document}
The issue is with glyph names. They should be "zero.oldstyle" or something having the period and suffix in the name. But the development of the fonts is stopped and no further versions are expected.