When we're talking about a state-level actor (and one supposed to be quite good at this), I think you'd have to to worry about more than that. 0-days in the operating system, supply chain attacks, and even one party in the conversation being compromised.