>On what grounds can we assume that?

because the bugs they discovered were yet undiscovered?

Or did they hire a team of cybersecurity specialists with the vast amount of funding at their disposal? I don't think its reasonable to assume they used none of their other resources to search for something that could be a very profitable marketing campaign.