Developing this type of malware is a lot more complicated than developing some web service or database. For instance the attack path isnt immediately clear and

Developing this type of malware is a lot more complicated than developing some web service or database. For instance the attack path isnt immediately clear and there needs to be a period of developing proof of concept exploits that are then tested in a variety of environments, there needs to be persistence techniques developed, there needs to be a C2 system, there needs to be a methods to avoid detection. Stuxnet was probably a collection of many 0days that were used in conjunction. Each 0day probably takes months of "dev time" at minimum to develop.