Ask HN: What is the state of private exploits?

How many zero day exploits are available to private groups? How many private groups are there? What is the ratio like now? I’m looking for a general idea how exploits are shared these days.

I want to know how likely an average person could pay a private group to target another average person’s up-to-date iPhone or computer.

My mental model has been script kiddies have known exploits. They are the last to get exploits. They cannot get into updated devices.

Rich private groups, state actors and NSA have all the zero day exploits and they wouldn’t waste it on normal people.

Private groups for hire have their own exploits or privately share with other groups.