It's an open secret that they both build them and buy them. Where the stuxnet ones came from is uncertain, but it could have gone either way.

I've heard they'll actually pay for one they already have if they hear a broker selling it. In this case, they are paying to keep it scarce (as these deals come with exclusivity).