But this is reversed for a watering hole bug against an organization. They only needed to get into one stack one member of the org uses and stay. Their reason for releasing multiple chains of attack at once instead of whenever their current attack is patched is unclear unless they want to get into multiple organizations where some avoid a diversity of exploitable software.