It’s literally their job to do that kind of thing, but was there legitimate concern in the UK that they unnecessarily targeted people in a malicious way?

You don’t just burn a vulnerability like that without a target.