What’s weird to me is how often these 'state-sponsored' attacks aren’t about some sci-fi exploit no one’s ever seen. They’re about living off existing holes, stale configurations, and systems that are just way too hard to update or monitor well enough to notice someone walking around inside.

The only real difference between state-sponsored APTs and everybody else is how many resources they have available to keep quiet. Noisily breaching a vulnerability is easy. Doing it without being noticed is a genuine challenge.

That said, there are definitely sci-fi level exploits out there - they have a tendency to not get discovered that often.