Probably because

1. It's a claim.
2. The devil is in the detail. They were probably not shopping for an exploit, but for other monitoring software. The article indicates as much.

The "phone exploits too to built it in their app" from parent is not really supported in the article.