Most likely they buy exploits on the market, like basically everyone else. No reason to limit yourself only to the first party knowledge.