short answer: some people are good, some people are lucky, and some people are good and lucky. It only takes one from the latter category to find these things

short answer: some people are good, some people are lucky, and some people are good and lucky. It only takes one from the latter category to find these things longer answer: It is definitely really damn hard these days. Even disabling the mitigations, it's still pretty hard to find and a vuln and write an exploit. But many people who find these (not all though) work as part of a team, where they can parallelize fuzzing efforts and combine/chain knowledge and other exploits much better than an individual could. The level of expertise and talent that some of these people have is absolutely incredible, and experience is worth a pound of gold for these types of things, and some people have years or decades of experience.