It doesn't even have to be an undisclosed vulnerability.
iOS 9.3 was released today and included several fixes to vulnerabilities which allowed arbitrary code execution, including one with "kernel privileges" [1]
Now that these vulns are out in the open, maybe someone has offered to help the FBI use them to gain access to the phone.