This vastly overstates both the competence of spy agencies and of software engineers in general. When it comes to memory unsafe code, the potential for exploits is nearly infinite.
Stuxnet was pretty impressive: https://en.wikipedia.org/wiki/Stuxnet
It was a complicated product that many people worked in order to develop and took advantage of many pre-existing vulnerabilities as well knowledge of complex and niche systems in order to work.
[0] https://repefs.wordpress.com/2025/04/09/a-comprehensive-anal...