Yeah... it's hard to know what exactly they get up to in that world, but the floor put under their capabilities by what has been publicly exposed doesn't exactly support the "nah, it's all too hard and nobody would ever bother" argument at all. Even if we assume without real reason to do so that we've heard the most impressive stuff from them, but it's just a small sampling of the number of times they've used it, if your adversary is a state-level actor, you should assume the very, very worst. If you're wrong, it won't be by much.

Read Google's Project Zero blog, too: https://googleprojectzero.blogspot.com/ We don't know that these exploits in particular are used, but consider that Project Zero is the moral equivalent of a hobby for Google. What would it look like to have hundreds of people at that rough skill level, training each other, practicing all the time, and building software support for each other?

The capabilities of attackers are not bounded by your imagination.