I certainly didn't mean to imply that hacking the SSD firmware on its own requires state-level resources; rather, covertly rooting the SSD and chaining that into a successful attack on the host system is what adds up to an impressively impractical attack, especially if it's against a target where the host system is sufficiently secured that using the SSD as part of the attack vector is worth the trouble in the first place.