Probably more than a hundred; there are teams of dozens at the good corporate security groups and an unknown number working for governments and other organizations that don’t appear as publicly.

More than thousands should be able to find this kind of security bugs, potentially many of them from state-backed hackers from China and Russia.