Humans do it for free. I've got two Amazon Fire tables from a fire sale for $15 each and used a package, that exploits the SOC, from the XDA forums to install full Android on them. Every smartphone I've had before this free Oneplus Nord N30 was rooted and then and had a custom android installed, many of the root processes relied on doing exploits all the way back to my CyanogenMod days.
I mean finding exploits yourself on devices especially ones without much public knowledge or discussion around it.