“Where would they get the cruise missiles?”
Even a cursory web search shows Iran has several models of cruise missiles (Meshkat, Soumar, etc.) which can attack KSA. Iran has thousands of cruise missiles.
The parts, the guidance subsystems, the warheads, all of these things had to come from somewhere. Iran does not manufacture, they assemble.
There’s an arms trade network that supplies these things. Rogue Russians and PRC Chinese along with Pakis are likely to be involved.
Iran has been on the non-proliferation list for a long time and that means their missiles are procured through the black market of arms dealers. There is a global agreement to deny the Islamic Republic of Iran these weapons.
https://www.fdd.org/analysis/2018/02/22/iranian-cruise-missiles-also-a-proliferation-threat
The question remains, where are these missiles coming from?
What groups are violating the sanctions?
Rogue elements of our own CIA are involved. And some of these rogue players have been on the inside.
Illicit weapons parts on black markets are not easy to carry. It’s not like opium products which are easy to carry. There is no garage where a few bad actors are making critical missile subassemblies. The parts are coming from manufacturers that are known and registered. They are few and far between, easy to monitor.
In Bill Clinton’s second term, PRC had no missile guidance systems worth making. After Loral staged a freak missile failure, PRC got what they needed by confiscating the downed missile.
PRC may be involved unofficially. It’s a good bet they watch their missile confab facilities carefully. PRC workers are known to steal anything they can. PRC hates Trump because he calls them out. But even they would be careful not to arm Iran unless there was an oil deal in it for them. That could very well be or have been under Obama but not with Trump.
In whatever way Iran got these missiles, there’s a train of characters behind the black market that provides the critical parts.
Our CIA has human assets among the black marketeers but some of those assets are double agents; they can be bought for a price.
Hillary Clinton and her network have billions stashed away offshore. It’s no leap to suspect those funds are involved.