This was true for a long time, but now that we have state actors with the capability and willingness to engage in long-term attacks (see: Jia Tan), the way we assess these threats probably have to change.

How does this change with identities? What stops a state actor of investing in a years old persona that builds trust to be used in an attack?

For an entity like North Korea, it's relatively easy to create a bunch of online personas and invest into their long-term online presence by (for example) contributing to multiple different projects. Once a person has to be personally identified, though, the effort and difficulty goes up drastically.

It can be a good first order approximation if you don't wanna take the time to examine the code like by line looking for SQL injection opportunities or whatever