I would argue that the learning is circular, as exploit development learns from mitigations just as much as mitigation development is informed by exploits ;)