Like others, I'm also left wondering what methods the US is really using. Obviously, it's too soon to disclose all the details. But compare this (where the few strategies disclosed involve methods like "guess the answer to a security question") to something where we do know the details.

For example, the Stuxnet worm used multiple OS zero days and involved hacking or otherwise exfiltrating signing keys from multiple other third parties (https://www.quora.com/What-is-the-most-sophisticated-piece-o...). I bet a lot of that sort of thing is going on these days too, and we just don't know about it.