Instead of waiting until zero-day exploits to happen, how to preemptively find zero-day vulnerabilities in order to deter zero-day exploits? There has to be a better way.
Companies don't just sit and wait for zero days to happen. They review their codebase all the time for bugs, they test their products. Well, reputable companies do.
Companies do use the same methods any security researcher can: fuzzing, debugging, source code analysis, and they have the knowledge on how and why a piece of code is written in some way, what it should do and what not. And they have a list of problematic areas that need more attention but they don't have time or incentive to fix right away.
When you read the Release Notes on an update package, they usually have "bug fixes" listed there. They would be a zero day if the update didn't fixed it. That bug could have been found by their internal review process, or an user reported it, or a bug hunter. But it got fixed, so for those who update the software, it's not a vulnerability anymore.
Similar to how QA (Quality Assurance) involves testing products both in production and in testing environments to try and preemptively find functionality/usability bugs, security teams do multiple types of review and testing to find vulnerabilities (or "security bugs"). Different tools will be used, but the ideas are quite similar.