^^that is a very limited & misleading definition of zero-day exploit.a zero-day exploit is not dependent on anti-virus software definition update but the vulnerability in program/OS.here is a link for you about the infamous zero-day java exploit:
Zero-Day Java vulnerability wreaks havoc on computers worldwide | Malwarebytes Unpacked
it is called zero-day because it is the 1st instance of this exploit.as soon as it is released on web it becomes known & loses its zero-day definition.note that oracle released a patch for this exploit within 72 hours after it it is first known on web.
also read this:
Another Java Zero-Day Vulnerability Hits Black Market - Security -
What does a starting price of $5,000 buy? "The hacker forum admin's message ... promised weaponized and source code versions of the exploit. This seller also said his Java 0day -- in the latest version of Java (Java 7 Update 11) -- was not yet part of any exploit kits," said Krebs.
& that is just the starting bid & considering that even $10000 exploit packs didn't have this exploit at that time you can easily guess what would be the selling price of this exploit(at least $20000 or more in my opinion).now tell me if you have acquired such an exploit after spending this much amount of money & know that after releasing it on web it will get fixed within 48-72 hours who would you use it against.some ordinary joe doing one or two few hundred $ transactions in a week or some fortune 500 company/investment firm doing million $ transactions daily on their pc systems.
those sites you mention from where you can download "zero-day" virus/exploits are nothing but gimmick.like i said above zero-day is useless once it is released on web within a few hours.no professional hacker worth his/her salt will even visit those so called sites supplying "zero-day" viruses.these zero-day exploits go for thousands of $ on such underground message boards/forums that none of us had or will ever be able to even visit.stop thinking too much & just use the real world common sense.no one is going to use a team of navy seals to kidnap you if you are a mere mortal who does not possess critical state secrets.if you are an average joe & keep your pc updated with all os/java/flash etc patches & a good free antivirus like avast & doesn't click on random links promising $5 iphone you will be safe.