As someone who has worked Vulnerability Research/Exploit Dev for US based companies I'd consider this a bit misguided and is likely coming from someone not in the Vulnerability Research/Exploit Dev industry. I'm guessing you're getting these numbers from just reading Zerodium:
"""
The zero days are likely occasionally being discovered and fixed, but buying a zero-click zero day for Android/iPhone on the black market only costs on the order of $1-2M at retail
"""
In reality the final packaged product is worth exponentially more.
Also, Israel produces some of the best security research talent on the planet due to their national focus on cybersecurity, and funneling some of the most talented students in the country directly to 8200 starting in high school, and some of them end up going to NSO group after. None of the vulnerabilities/exploits in the Vault 7 leaks come close to the sophistication of the FORCEDENTRY exploit. I'm not saying the US doesn't have better capabilities and the NSA most certainly does because they have suppliers like Azimuth, but a lot of what you've stated is based in fantasy.
As a software engineer you're more than half of the way there. A lot of people pivot into this industry with almost zero experience because it's pretty fun and they end up learning computer science along the way.
In parallel, I'd recommend studying real security vulnerabilities in products that use technologies that you have a background in. For example, if you are interested in both Web technologies and C++ ,I'd start studying Google Chrome, specifically it's Javascript engine V8 [1]. There is an entire cottage community of both offensive and defensive people looking for vulnerabilities in chrome so it's a good way to get started because there's a lot of information out there. One amazing thing about security engineering is that you get to learn how all of these amazing technologies work at a deep level, because you need to understand it almost as well as the developer to find security vulnerabilities in it. For example, I have a very deep understanding of how technologies like RTC, Browsers, Sandboxes, and the IOS operating systems work from auditing their code and finding security vulnerabilities.
I'd recommend pivoting into security engineering. Security engineering, even at big tech companies, can be fulfilling as you are often protecting dissidents, journalists, and human rights activists from surveillance. Even at companies like facebook, you can work on protecting dissidents [2] while contributing very little to the company's ad business. There are also opportunities that pay well at non-profits like Amnesty Tech as well [1]. The challenges are surprisingly technical and your adversaries and coworkers are some of the most talented computer scientists in the world [3]. It also surprisingly comes with around a ~25% pay raise from SWE (I make $750k TC as an L6) as there are so few people interested in it. Switching into security engineering was the best decision I made and I now work with an almost completely clean conscious.