It’s not “easy”, it requires a complex infrastructure of exploit devs (who can sell their findings for millions in some cases) and the companies who package these exploits together with implants and sell them.

https://www.packetlabs.net/posts/demystifying-the-market-for...

"Most browsers are highly secure"... erm no

One side uses AI to find them. The other side probably needs to keep the holes open for NSA, as the multiple 0 click root exploits that happened in the past to the iPhone with very similar techniques suggest.