It doesn’t matter about easy or hard. It’s possible and then we’re just talking about the $ required to purchase it on the black market - government contractors

It doesn’t matter about easy or hard. It’s possible and then we’re just talking about the $ required to purchase it on the black market - government contractors don’t really pay well unless I’m misinformed. And a vulnerability remains a vulnerability forever until your victims patch it. Said another way. Based on CVEs most of the focus of attackers is on memory safety vulnerabilities which means that regardless of price they otherwise fetch, these are still the cheapest and most valuable exploits to uncover in terms of exploit power / dollar spent.