...maybe these are just 'decoys' to make everyone else think "their tools are pathetic"?

maybe they have stuff like james bond watches that can burn stuff with lasers & stuff.

I would assume they have their ways of obtaining admin access. Probably those auth-bypass tools have a separate codename.

Dumbo itself needs admin access, but nobody said they don't use multiple tools in combination.

With the various NSA leaks, we've seen that this is exactly the process. One suite of tools to compromise different types of hardware, and another suite of tools to be loaded depending on what outcomes are desired.

It's worth remembering that the picture looks very different for an actor that's known to access 'virgin' devices before they arrive at buyers. If you can get unlimited physical access once, suddenly your primary goal switches from remote access to creating tools that can go undetected for as long as possible.

Exotic tools have a downside too. Eventually people are going to notice weird shit and get suspicious.