Well one way is that they are building tools that exploit those vulnerabilities, and leaving the tools on poorly protected "staging servers" where they can be stolen and revealed to the world.

Whoever stole the tools this time announced them to the public -- how many times have the tools been stolen in the past and kept quiet so they could be used?