To expand on this point, it is absolutely not the norm that even very serious vulnerabilities in web browsers, operating systems and very widely used libraries

To expand on this point, it is absolutely not the norm that even very serious vulnerabilities in web browsers, operating systems and very widely used libraries have published exploits. There are qualified security research teams that develop targeted exploit implementations for exotic and very impactful vulnerabilities. They do not need (or want) to publish the exploits because a) that's a valuable product and intellectual property and b) turnkey weaponization reduces the half life of the vulnerabilities (and therefore income potential). The people who publish exploit implementations generally do so because they have no interest in seeing the vulnerability flourish and because they would rather have industry fame than a short term payday. If you want to improve your credibility in the security industry, identifying high-impact security vulnerabilities (i.e. CVE worthy) is enough. If you want to earn money by dealing in vulnerabilities, you generally want to develop exploits for them (or give them away for relative pennies on the dollar). This is a roundabout way of saying that the absence of easily available exploits does not mean that software is secure. On the contrary, it could be an extremely high value target. There are different incentives at play - on one hand, merely releasing details of a vulnerability is enough for recognition, while the most lucrative payments go to weaponized vulnerabilities. If I were to, say, identify a series of two or three vulnerabilities that can be theoretically chained to achieve remote code execution on an iOS device, I could do one of two things with that. I could report it to Apple and receive up to $200k, per their recently developed disclosure program. I could also sell this for 2 - 5 times that much with a complete exploit. The first option is a great payday and comes with (effectively) never needing to interview again. The second option results in a much better payday (life-changing, perhaps) with essentially no recognition. If you can consistently churn those out, the second option is probably better if you're optimizing for wealth. But realistically speaking neither party is exceptionally incentivized to publish an exploit that you could just find and download.