This is hard for me to believe for a company the size of Apple. They were recently the wealthiest company on the planet and are worth over a trillion dollars IIRC. They could slow down their software development process, focus less on adding new features, and prioritize fewer security holes. It seems like such a huge risk to them that their devices are basically always vulnerable. But the general public never really hear about these 0-days so they may have some ability to ignore the problem.

The cynic in me imagines that someone at Apple knows about these bugs and they are shared with spooks for exploitation. One could imagine that even for a responsible disclosure program, they could share details of every new vulnerability with some three letter agency who could have months of use out of them before a patch is finally released.