I know there’s a mechanism for 3 letter agencies to get a warrant allowing them to break into insecure hardware owned by US citizens and companies, to patch said vulnerability.

The FBI did that recently[1]

[1] https://www.malwarebytes.com/blog/news/2024/02/fbi-removes-m...