This seems to be operating on the premise that everyone knows of every exploit that exists. There's also an enormous incentive to hide working exploits.

Any. Not every.