I think the old “Mossad is gonna Mossad” thing is still true. Good security practices are mandatory, and will keep you safe 99% of the time.

But when you have what appear to be state level actors using 0 day exploits... you will not stop them.