That was one theory I had in mind. My guess is the organization developing these exploits form teams of people focusing on a single exploit, with each person on

That was one theory I had in mind. My guess is the organization developing these exploits form teams of people focusing on a single exploit, with each person on the team having deep domain knowledge in a single subject (UEFI, Windows Kernel, etc), and they use that knowledge to develop their portion of the exploit chain. People who developed such specifications in the first place, like UEFI, would be great candidates for an organization looking for someone with deep knowledge of the subject.