It is difficult to protect against state actors.

But a lot of attackers are not state actors. They are private actors (whether lone individuals or groups) going after the low-hanging fruit. Protecting against this threat is a lot easier.

And for a lot of enterprises, the second category is a bigger threat than the first. Even if the NSA steals all your data, they are unlikely to release it to the general public or use it for extortion. The later group are much more likely to do things like that. If the NSA hacks you, you quite possibly will never know they've done it. If the later group hacks you, they'll make sure you know they've done it by the pain they'll cause.

(Of course, I realise how for companies in certain sensitive industries, such as defence, aerospace, semiconductor fabrication, etc, the threat of state-sponsored cyber-espionage from competing international powers is a real threat – however, I think in those cases one's own country's three-letter agencies are often keen to be helpful.)