[mvanaltvorst]

It blows my mind that there are people who manage to find exploit chains like these, amazing job!

[PeterisP]

The article goes into detail on how much trial and error effort it goes into making such an exploit chain - approximately two months work each for two people. Even for other people who have the required skills, making such a time investment - with no certainty of succes or reward - is a big barrier. Perhaps the math works out differently for blackhats as the payoff is larger and perhaps more certain if they do get to a working exploit.

[junon]

This is generally through the use of (often custom) analyzers. I would wager, though I have little empirical evidence, that most non-trivial zero days of large software like this are not strictly manually discovered.

[skrebbel]

Isn't this a bit like saying most software these days isn't manually built, because they use compilers?