Undisclosed "1-day" is real and has gone on forever. A popular set of tools is binary diff tools such as the now defunct Zynamics acquired by Google. There is evidence. The amount of tooling around examining MS patches should convince most.

http://www.blackhat.com/presentations/bh-usa-09/OH/BHUSA09-O...

http://www.phreedom.org/presentations/reverse-engineering-an...

People built businesses around this.

With so many eyeballs on release diffs, undisclosed vulnerable were often discovered (and still are). With the number of experts on file observing this it should not be controversial at all.