True, but they don’t even need 0days or software exploits to breach the systems. The data is harvested legally and sold to whoever wants to pay for it. Insane amounts of data about everything you do is made commercially available by phone platforms, tech companies, apps, banks, email providers, retail establishments, cell phone carriers, governments, and of course their continual data breaches.

Anybody can target you too, it doesn’t have to be espionage outfits or state sponsored threat actors. It’s just for sale.