From what I've personally seen, it's typically the security organization's responsibility to construct threat models and risk profiles, which basically turns into more general downstream security guidance for product owners and devs. The people working on the products don't necessarily need to know or care about particular adversaries or scenarios or threats; they just need to understand application/network/data security concepts, be constantly vigilant, and not get too annoyed if a security team tells them they need to switch to a new way of doing something. A web developer should know what XSS and CSRF are and should know a S3 bucket with customer data and no ACL is bad, but they don't need to know what an APT or cyber kill chain is.
Any vulnerability, misconfiguration, or exposure could be exploited by many different kinds of entities for many reasons. A company with a good security department will have a dedicated threat intelligence and research team to consider specific risks and adversaries, which they will share with adjacent security teams; that information probably isn't relevant to most people just working on a product. But sure, some of it may reach a product owner if there's a particular kind of risk inherent to it (like if the product is offering secure end-to-end encrypted communications as a selling point or if they're in a sector that's been heavily targeted by state actors).
Every organization and product will differ a lot, but for any company with a not-insignificant presence in an industry, state actors (APTs) are pretty much always going to be a risk. The odds of being hit by an APT are pretty low for most small companies, but the risk is always there.
In terms of what's most likely to regularly affect the average company, financially motivated cybercrime has pretty much always been and remains to be the biggest issue. Much like regular daily crime, I suppose. It's people just looking to make a buck. Commodity malware like ransomware and banking info stealers, vuln scanning bots that pop a shell on their web servers and sell access, phishing emails spreading malware or impersonating executives and requesting wire transfers are probably still the main risk for most companies out there, of all sizes. This is probably the biggest problem for most companies whether they're entirely tech/software-focused or just a retail outlet or restaurant.
Sometimes you'll get more organized and sophisticated cybercrime actors targeting specific organizations in an APT-style manner, but it's still almost always using those tried-and-true basic tactics. And believe it or not, many state-sponsored APTs themselves often go with generic tactics, too. Most influential countries' intelligence services do seem to have at least one "A Team" conducting cyberwarfare/espionage, but some also seem to have a lot of grunts just looking for low-hanging fruit, and they're usually not much harder to detect or stop than more typical script kiddies you might otherwise encounter. Often the "A Teams" will intentionally stick to the most generic stuff they can find, too, to avoid tipping their hand that they're smarter than they seem and to hide the fact that they have access to non-public tools and exploits (both to prevent their "weapons" from being burned and to not seem like they're an APT). The most sophisticated groups will only pull out the big guns if all of the generic techniques fail.
I'm not really well-versed in industrial espionage and competitors reverse engineering software, but I think it's not really something most companies need to care about. If your competitive advantage is actually at risk just because someone reverse engineered one of your binaries, there's probably something very wrong with your business model. The companies who need to care about that kind of stuff are usually already well-aware.