And who's buying them? Generally, state actors, directly or indirectly. There is an entire ecosystem of Israeli "security" companies that exist to farm out these exploits. This is a big part of why Israel is such a key component of the American national security infrastructure. Israel is largely beyond the jurisdiction of American courts and any kind of direct scrutiny by the government.
It's a bit like how the US isn't (technically) allowed to spy on US citizens. How do they get around this? By farming out such activities to allied intelligence services, particularly Five Eyes members.
This entire ecosystem and marketplace just wouldn't exist if Android or iOS were fully backdoored.
Protecting user privacy delivers close to 0 shareholder value, being friendly with nations wins you billions of dollars in contracts, regulatory protection, and friendly courts, it's a win-win for big companies and surveillance states to be friendly with each other.
Monopolies are easy to influence as they don't even have to care about the optics.
Who believes that their Apple-Google device doesn't phone home to Five Eyes directly or indirectly. Who would care or be surprised if they announced publicly that they did?
But with that being said both Apple and Google store a lot of data about you, and they are willing to "cooperate" with the government, and they did hand over data in various of cases Apple included [1]. For some reason, people think of as the "privacy company".
btw, big tech also get harassed for similar requests: The UK, for example, is still pressuring Apple to build an encryption backdoor [2].
[1] https://www.apple.com/legal/transparency/ [2] https://www.eff.org/deeplinks/2025/10/uk-still-trying-backdo...