They don’t catch zero-day exploits, as those are vulnerabilities in programs that were discovered to be used in the wild. They will eventually catch the malware dropped through those exploits, though.