It's more akin to manufacturing portable arms factories, that can also replicate themselves.

Lose one and you're SOL.

Physical objects take dollars and time to design and produce at scale. Most of these vectors take time to design and money for living and the initial computer, but the implementation of them takes almost no money nor time (ok, yes a few miliseconds and the electrical power, but it's basically nothing). Corey Doctorow has said it best : "A lot of threat modeling is based on something like economic rationality by your adversary: you assume that no one would spend $10 to steal $1 from you. But with nitwits, all bets are off: this isn't about designing a safe to keep out a smart mastermind cat-burglar, it's trying to figure out if a drunk and belligerent dudebro will walk up to you on the street and punch you in the face to blow off some pent-up hormonal steam."

(https://boingboing.net/2017/05/13/heroism-through-domain-squ...)

It's vastly faster and more reproducible, enough so as to make it a different environment with different considerations.

If the vulnerability had come from Google Project Zero, the same worm could have been created. The only difference is a lower barrier to entry, but with enough malware authors out there, even GPZ's descriptions are enough to cause vulnerabilities to turn into exploits in the wild. Why does the discoverer of a vulnerability matter if the vulnerability was patched before it was publicly announced?