How do people find SoC exploits

I was looking to find how xyzz, Chaosmaster and others cracked MTK SoCs.

One guy cited an article from Oxygen Forensic Detective, a tool for Digital Forensics, which claimed that Oxygen can crash BROM mode in MediaTek devices, in addition to the ones from the LIEBERBEIBER blog.

So I might have to look into how the forensic tool makers do this too.