They left out one other opportunity: they purchased the 0-days from a broker or company like Zerodium. The cost might be worth it to them if there were high, perceived odds of getting in.
I'm not saying it was easy. I have no idea how those programs or the brokers supplying them work. In this hypothetical scenario, they could be regular customers operating within the suppliers' expectations. Alternatively, a broker has some 0-days that the big-name companies aren't buying or not at that price. Potentially already has them. Some other party is willing to buy them at a nice, but reduced, price.
When I did thought experiments on it, one of the big issues for me was how to show buyers the vulnerability without losing money from them stealing it or deal with them claiming that they already had it in a way that minimizes risk to all parties. It was a tricky problem. Folks selling on the side was a potential result in some scenarios.
