yep! pretty much, but selling the supply chain and specs themselves is almost as bad. It took PK almost 30 years with PRC information transfer to build the Islamic bomb, but 10 for NK thanks to Khan Labs.
Neither Libya nor Syria have them, do they? And Iran was close, but the treaty (the one the last US admin tore appart) stopped them for the time being.