It's not as if non-WhatsApp zero-days are hard to come by for nation-states. If it wasn't a video shared by WhatsApp, it was going to be an iMessage text PDF appearing to be from one of his assistant's email. I don't think governments need to author vulnerable software: they can outsource that to the private sector for $0 by doing nothing and decompiling/fuzzing/analyzing whatever comes out.