[alangpierce]

Are Windows 0-days really that common? I thought they were usually saved for really serious attacks, e.g. from state-sponsored actors, not scams on the level of "pay some random person $15 a month to attach a mysterious device to their router".

[eponeponepon]

I can't answer your question authoritatively, but there are plenty of organised criminal enterprises in the world with state-level resources.

[floatboth]

Not just a question of state-level-ness, but of targeted/mass. Burning a 0day on a mass scam is really, really stupid.