Nobody knew about the zero-day exploit employed against Tor browser,
  for example, and there are almost certainly many more tricks like that
  up their sleeve.

I had actually been patched already upstream, so it was not really a zero-day. I'm not sure if it a patched Tor Browser Bundle had been released and people just hadn't upgraded, or if the patch hadn't made its way to the bundle yet.