He didn't say that it's easy, just that it isn't so hard that you need nation-state backing to do it. Judging purely from their capabilities, Equation Group could be a small group of college graduates who make a living with hacking and don't settle for the low-hanging fruit.

Of course the other evidence strongly suggests that this group is NSA-employed, but the real reason why their malware is so much more sophisticated than anything else out there isn't that nation states have staggering amounts of resources, it's simply that normal malware doesn't need to be sophisticated.