[MichaelGG]

But having state sponsored employees is so obvious, effective, and cost efficient it seems odd to assume it's not being done. The US found a bunch of Russian spies a while back.

But true, it's not right to assume any particular vuln is from spies.

[kuschku]

Correct. But you have to assume the spies have vulns in there, either intentionally added, or, if they found vulns, they simply reported them to their agency, instead of their employer.