Yup. Moreover, most "state espionage" and the like is really just a state-sponsored variation of garden-variety opportunistic/criminal activity that would otherwise be quite ordinary. This is something that most people might not generally realize, because there's so much focus on high-profile espionage. But that's rare and not at all the common case.

Seriously they destroy Iran nuclear enrichment with stuxnet by leaving usb flash drive around. The worker took it, kept it as there own and use it at the nuclear enrichment site.