In my understanding, state-level actors are not exactly notorious for using exploits for mass surveillance (they use a little bit less controversial means to achieve this), zero-day stuff is typically for single valuable targets. Or am I wrong?