The problem with these arguments is that by keeping the bones they do have secret from the community they are denying the ability of others to present their own bones, so why Kaspersky and Symantec and others may not have had all the bones individually they may have had enough of the bones separately to build a model of the Dinosaur much earlier that 2 years after the first bone was found by either company.
And last I check the UK was part of the European commission which has been targeted. It not beyond the possibility that Five eyes or one of the Five eyes countries found Regin but decided to reverse engineer it and use it themselves, which is one of the the big risks of using cyber weapons once they are out there anyone can get hold of them and start using them themselves.
China is also conveniently missing from the list of targets, they aren't slouches in the cyberwarfare industry.