One did "fall off a truck" and into Moxie Marlinspike's hands back in 2021: https://signal.org/blog/cellebrite-vulnerabilities/

A bunch of their software was also leaked in a hack back in 2023: https://ddosecrets.com/article/cellebrite-and-msab

I wonder why they haven't switched to a more lucrative model of remote unlock/forensic acquisition using something like WebUSB.