This happens on an almost yearly basis. Source code for ~all major windows releases is actively traded. (Same also goes for Apple, Cisco, etc...) Protecting source code that a huge amount of employees need access to is hard.

Previous public example: https://www.bbc.co.uk/news/technology-40366823

Many exploit devs have access to this stuff, but would obviously never publicly discuss it, fearing leaks and liability.