>this basically comes down to State Actors ... or Everyone Else
This is oversimplification if not misleading. There are also Bad Guys (who aren't state actors), who usually can't reach for your data. But occasionally they can, when rare Planet Parades like Heartbleed or Meltdown make the news. And they are happy to use this one-in-a-lifetime chance to sell access to your data to everyone else.
I guess I don't understand how something like Heartbleed can hit you if you don't click on boner-pill ads, Fastmail's servers don't get hit, and you're not installing random apps from random internet folks?
This is oversimplification if not misleading. There are also Bad Guys (who aren't state actors), who usually can't reach for your data. But occasionally they can, when rare Planet Parades like Heartbleed or Meltdown make the news. And they are happy to use this one-in-a-lifetime chance to sell access to your data to everyone else.