I would be surprised if a large company with very good security practices could resist them indefinitely, Equifax wasn't going to hold them off.
The difference between state actors and regular thieves is the state actors don't want anyone to know about it. Sony got wrecked by North Korea because they wanted them to feel the pain. That could happen at almost any company, just the state actors want a long-term strategic advantage not a short-term one.
The ubiquity of technology in all aspects of our society makes us extremely vulnerable to losing a digital war. We have so much more to lose, and so much more surface area vulnerable to attack. Seriously, North Korea was able to assert their will on us just to (successfully) keep a movie from being released to theaters.
Also, really, none of this matters for 99.99% of the companies out there. The weak point is far from hiring practices. The weak point is almost always cybersec or social engineering.
From: employee name ([email protected]) Subject: direct deposit
Boss, I have a new account, please change my direct deposit info.
Yours, Employee name
They changed the direct deposit info. Need a wetware version update.
You could just offer non-Chinese Americans a hefty reward + a Chinese passport as a reward for their espionage. Given the number of Gen-Z or Millennials straddled with debt, in an era with little company/employee loyalty (both ways), it seems like the recruitment pool would be quite big. Pick someone "All American" looking and be done with it.
Both the Soviets and the Chinese have done similar things to steal military secrets.