They buy and build unpublished exploits and hide them so that they don't get patched - that's why the key software is tricky to get even for gov't agencies, som

They buy and build unpublished exploits and hide them so that they don't get patched - that's why the key software is tricky to get even for gov't agencies, some things for breaking fully-patched recent phones Cellebrite will only do in-house so that the customer can't leak and 'burn' the quite expensive exploit which was used.