Ghidra itself is still what they use, they released it so that potential hires don't have to be retrained from IDA Pro. What they don't release, however, is Ghidra plug-ins. I'm sure they have a vast trove of plug-ins for specific reverse engineering they do, and probably some that check for known holes they can exploit.