2 million USD gets you a smartphone zero-day*, according to rumours, something like a single ATACMS missile.
* geometric mean of 200k and 20M: https://techcrunch.com/2023/09/27/russian-zero-day-seller-of...
That's a strategic capability that very likely requires multiple attack chains, not a single exploit. For Western countries, cost is probably the least significant factor in deciding to use it.
One would want to be certain that option is available, but only when absolutely necessary. Using it on a random Tuesday would take that particular option off the table forever. Best case scenario, Russia discovers the means by which the attack was carried out. Worst case, they retaliate with nuclear weapons.
Globally, I believe there are only a few countries capable of executing such a plan.
Alternatively, maybe it is possible, but the US doesn't want to escalate? You saw how reluctant Biden was to authorize missile strikes inside Russia.
At least, if it was possible.