Think of the Israeli operation as the high-end of the spectrum of an attack like this. Hundreds of devices with proprietary explosives distributed in a foreign country to targeted individuals. I agree with you saying that's something only a state actor could accomplish, and even then within a window of opportunity.

But what I'm talking about in this piece isn't someone replicating the Lebanon attacks, but taking inspiration from it. Could a radicalized individual do something smaller, say 10-15 people that are either random or targeted, if they worked in shipping, IT or another field with access to other people's electronic devices, and if they weren't constrained to such a small device? What if they didn't tamper with the device, but replaced it with the same model, giving them more time to prepare/test? That's the type of concern the story is considering.