This is nonsense. Security breaches can be discovered and used by anyone with the right knowledge and skills. Geohot was not sponsored by the CIA or the FSB.
I can imagine many use cases where they would e.g.
journalist enabling this before working on an article that was critical of a foreign government. Or any government contractor, NGO, embassy worker etc.
That's often not enough.
You need a lot of resources and most importantly prosecutorial immunity.
From my own experience and from the postmortems I have had access to, most of the time this a work of patience and skills.
In my opinion, this is a way of saying to the public that their devices is secure against everything but state actors, this is simply not true.