I don't know the exact prices but I know there are ready to buy botnets on the Darkweb. So it's actually quite commoditized - and there are many +3 year old android phones that don't get security updates anymore, it's not a rare resource.

If a major player does so, they probably need to pay a law firm which in turn uses an IT service shell company which costs a lot - I'm speculating here, this is far from any evidence that this happened.

.