Mostly I mean they research vulns and buy exploits on the open market, but yes they are also getting backdoors placed in commercial products.