- Buy exploits on the market, with the US govt being the biggest buyer.

- Buy data off legitimate advertising and intelligence companies

- Hire people to find bugdoors

- Hire people to infiltrate all sorts of companies and extract information or plant bugdoors

- Convince or coerce companies to plant bugdoors in their own products

- Do the hacking themselves, plant hardware backdoors and so on

Unsurprisingly, they use all available methods.