I'd go with the latter. Remember, the highly paid web guys at the large organizations find out about alot of the 0-day attacks around the same time the rest of us do.