State actors aren't mythical, they're working with budgets same as everyone else, and they don't have "unlimited-strength attacks". They weigh what to burn their zero days on, use social engineering etc low tech attacks when it's more efficient, and so on.