> it's not like there's a lack of groups out there trying.

Indeed. And those who knows how to implement this, might also be the ones with capabilities to deploy it on a large scale (via bot nets or whatever).

What about state actors, suddenly getting a possibility to plant backdoors in millions of websites, etc.

You don't have to be too imaginative to see the "economics" of this.