It definitely does take a considerable amount of work to get proficient to that level and even more to develop the intuition of where to look. It must be stated

It definitely does take a considerable amount of work to get proficient to that level and even more to develop the intuition of where to look. It must be stated, however, that the authors of these blog posts are not attackers. They are proactively finding and demonstrating where software already in common use could be exploited by attackers. Just like how research into cryptanalysis strengthens cryptography for everybody, research into software vulnerabilities and exploitation strengthens software security for everybody.