Not many of the people commenting in this thread, to say nothing of the general population, are founders of security research firms. We may have seen noisy rumours of these things, and even noisier hints at their scope and extent, but we're not being personally mailed verifiable primary documents by first-party actors.