What can we do? Get activist types to stop using Windows. That removes about 99% of the attack surface. I'd like to see the UAE successfully remote root a desktop running debian-testing amd64 and an xorg/xfce desktop. Yes, there's myriad security problems with Firefox and other things.... But every single state-paid RAT tool ivr seen is targeted at Windows.

education is important too. If you can successfully trick people into running a binary you gave them with sudo (or the equivalent) all bets are off.