why would 3 be unlikely ? The snowden leaks indicate that 3 letter agencies will use high value 0-days sparingly, to ensure they remain 0-days.

Also, there is a 5th (more likely) possibility: SA didn't find anything, but undiscovered holes do exist.