> This totally ignores the concept of "zero-days", vulnerabilities discovered that are only known by bad actors or known but not patched yet.

I'm not ignoring them, I'm just assuming that vulnerabilities discovered by bad actors will follow more or less the same distribution as those found by security researchers.