[lostnet]

> Stuxnet?

Probably not, once a vendor is aware the bug has a relatively short life and using it increases the possibility of detecting your attacks. To avoid constant maintenance, one must review code for new exploits and then not inform the vendor.

More likely they watched for indications that their bugs were independently detected to keep ahead once they were operational.