Apple could afford to spend a couple million dollars to find those same security problems and then fix them before everyone's phones became compromised, but apparently they weren't as interested.
Apple can (and does) spend lots of millions of dollars to find security vulnerabilities in their products, but it probably won't be the same ones that some malicious actor finds. All our devices are riddled with (hard to find) holes and that's not going to change anytime soon.
From looks of it many of the vulnerabilies could have have actually been found at the time of coding if some security best practices were followed
If you read the public statement issued, you’d know that Apple had already been fixing the problem before Google even reported it to them.