Remote attacks (e.g. say having a zero day in the sms messenger app. Not talking about remote in the sense of phishing emails are sent remotely or when attackers target service providers instead of users) typically get noticed and fixed really fast if they are used en masse. In practise it is much more common for attackers to pick specific targets in order to preserve how long their vector lasts for.