The Adobe one is a standard memory safety bug. This is the kind of thing you can find with fuzzers pretty easily, or by examining file formats for potential overflows. The exploitation techniques here are using ROP chains to get execution to shellcode from a JavaScript heap-sprayed shellcode. Both are widely used techniques, and there are tools to assist exploit writers in finding and using ROP gadgets.
I don't know Windows as well, so I can't speak to the second exploit.
Much like, say, JavaScript development the tooling and instruction is of a much higher quality and much more diffuse. If you're smart and you put in a couple of years you can do it too, and some of these vulns fetch millions, though they're frequently blown on pwn2own contests or otherwise responsibly disclosed. I suspect that that is going to change over the next couple years as every major government amps their cyberwarfare / int budgets.
It seems VirusTotal is a tool for running 70 anti-virus products at once against the same file. How can VirusTotal catch freshly developed malwares? How would VirusTotal even suspect that an uploaded file was fresh malware? That doesn't make sense to me.
Lets assume you know a threat actor always uses the same variable names during heap sprays, you can discover new malware from this threat actor with a Yara rule to look for this pattern.