Or, like, they have a root kit and it works so why reinvent the wheel? They have an attack payload so why reinvent the wheel? Just plug and play all the packages you need until you can compromise your target device.

But there is a very good reason to reinvent the wheel here: to not burn more zero-days than you have to.

Exactly! This is the part of the story that mystifies me completely and I would love to see some explanation.

The attack payload should not be so tied to an exact installation path that you can't just install it via a different exploit chain.