Breaking into a hotel room and installing a rootkit on a laptop does not require anywhere near that level of sophistication.

In many cases, obtaining a hotel room key requires only entry-level social engineering. How do I know? I've received keys for my own hotel rooms from the front desk with essentially no verification. Adding a rootkit to a laptop depends on how well-secured it is, but that's often little more effort than inserting a flash drive and rebooting it.

These things require the resources of an individual and skills that can be learned from a google search.

Breaking into a hotel room, and breaking into a hotel room without sufficient surveillance resources are two different things... Just off the top of my head, I can think of a few concerns. You'd need a rotating team of at least three persons to verify that the subject has left the hotel room, and isn't going somewhere for a very short time such as to the hotel laundry room, to a lobby snack bar, or such. You don't want to be surprised in the middle of installing a rootkit. Then you have to deal with the fact that the front desk staff might speak to the person later, like "Hey just checking your new key card worked OK?" "What new keycard?", alerting the person that something is fishy. You have to deal with the possibility that the person might have left a portable motion sensitive alarm stuck to the inside of the hotel room door, or a tiny camera somewhere in the room.

Lots of things can go wrong with this sort of plan. But it's not a one-person job.

You might have your rootkit totally prepared and ready to go, and find that the person has a sub-1-kilogram sized netbook/small laptop that they take with them literally everywhere they go, in a backpack, small bag, or purse.

You might have an attack prepared and get there to discover that the laptop has had its USB ports disabled in the BIOS, with a BIOS password set, and insufficient time to work around that.

You're describing the sort of operation a nation-state's intelligence services would plan, and I'm describing the sort of thing anyone from a crazy ex-lover to an unethical competitor might do.

Your scenario is obviously more likely to succeed and less likely to be detected, but mine works more often than not. Being sure I have not done anything to attract the attention of an intelligence agency is not sufficient to be sure nobody has gained physical access to my laptop and installed malware.

Which might very well be true as "software developer" is very vague. Same with security expert. Use the term "consultant" instead

Bootloader on an SD-card, a condom and lots of codeine