You're making the assumption that a government would not pay for the development and exploitation of those vulnerabilities, which is de facto false considering

You're making the assumption that a government would not pay for the development and exploitation of those vulnerabilities, which is de facto false considering the current "cyberdefense" capabilities of developed countries.