Let’s assume Pegasus is the furthest upstream (first to hack). Once it is fixed, security researchers (or hackers) can learn what the exploit was and how to use

Let’s assume Pegasus is the furthest upstream (first to hack). Once it is fixed, security researchers (or hackers) can learn what the exploit was and how to use it. How long before it ends up in something like metasploit?