The question is not necessary about technical details but more broad. I'm fascinated by the creativity involved in this process.
Since the news of Meltdown/Spectre I was wondering: How do teams like Project Zero come up with ideas to find 0-day exploits? Especially if we think of the ones mentioned which were there for decades.
Do they come in in the morning, get their coffee and say: "What would be the worst thing that could be exploited? Lets target the CPU!". And then spend an enormous amount of time studying it?
Or is it something like a coincidence: "While developing some tool I accidentally read some memory and I wondered why I was allowed to do this..."
I guess if you have a team dedicated to exploits, they wouldn't go after something by pure chance.
Edit: I'm not sure if it is a duplicate of this question. The reason: I'm not asking about the techniques of finding the exploit. It is more general: How do they even decide on a possible "victim" software. As far as I understand Project Zero, they generally try to find exploits - no matter where.
Maybe @Overmind is right though and it is too broad to ask such a question.