The State is commoditizing exploits and has been for a long time. They have special contract vehicles for buying the tech from private sector to be tailor made for specific use cases. The State will also purchase entire "companies" to be honeypots for bad actors to target. Or to obfuscate their involvement.