Usually people who exploit such security flaws find about about them by reverse engineering security updates.

I'm curious; what makes you say this? This may be true for the script kiddies out there, but aren't brighter hackers (of the sort that find the problems in the first place) more likely to target their attacks to more specific/profitable victims, making them far less detectable?