Both is the best option. Unfortunately there is just about nothing you can do to prevent a government sponsored org from building exploits from scratch to target certain individuals. Apple is doing pretty well at protecting the average person from mass malware like we see on windows and outdated androids.