Because a lot of security research is done by individuals or small firms, and the NSA doesn't generally review disclosures. I find it hard to believe this wouldn't leak, at least in the western world.

And? I don't know the CVE process, so I'm honestly asking while you're not actually answering. Who controls the release of CVEs? Sure, individuals can report something as a vuln, but does the report automatically create a CVE? Or do the reports get verified and then "promoted" to CVE? If the latter, then there's absolutely a part in the process that can be subverted

CVEs have absolutely nothing to do with finding out whether our devices are backdoored.

CVEs come out of Mitre, but lots of countries have equivalent systems or tracking codes. Further, large companies are pre-allocated blocks of CVEs to use.

But it’s irrelevant. The original position was that if govt are putting obvious remote access into devices, why has nobody ever seen and blogged or tweeted about it?