Given how these 0days were clearly “burned” for this occasion tells me the NSA has no shortage of them.
Just "SELECT * FROM nsa_exploits" would probably turn all our stomachs and I'd guess they still only have a small fraction of what exists.
Software is to a large extent built on default-unsafe primitives, and we wrest security from them at great effort and with dubious efficacy. We still have fights on HN about whether or not "memory safety" is necessary, and that is frankly so far below the level we need to operate that it would be humorous if it weren't sad. Granted, that fight is dying down as we gradually converge on "yes, it's necessary", but it's like level 2 and we need to be operating on level 18.
good thing we live in a free democratic society!
It's gotten to the point where full-chain Android exploits, traditionally easier to find and use because of lacking update policies and incompetent manufacturer chains, are worth more than their iOS counterparts: https://zerodium.com/program.html
Because of iOS' excellent update rate and generally very secure operating system model, I'd expect this to mean that there are so many exploits for either platform that the trade of exploits for the ostensibly more secure platform isn't restricted by the amount of exploits anymore, but rather by the rate the existing 0day stock gets burned by use.
I expect intelligence agencies to be fully stocked with more 0days than they currently need. Not just intelligence agencies either; for your average large international criminal organization, whether it's the maffia or the NSO group, there should be plenty of exploits to be found and bought.
https://twitter.com/Zerodium/status/1326498688621948928
now did they have too many? maybe. but maybe also because they were expecting apple to announce a new ios at the wwdc that was happening in june.. or maybe lots of 0-day exploiters suddenly wanted to dump their exploits knowing that apple was probably going to be patching them soon. oddly enough that tweet about resuming payment coincided with the release timeline of ios 14.
most of this is irrelevant though because we lack any information. what is, "too many"? 10? 100? 1000? it could be that just like any other middleman they sometimes need to sit on "inventory" and they can't just buy up that many at one time in case apple fixes them all in an update.