Except for the ultra slow data extraction part, all other aspects are feasible to a highly motivated state actor. There's a habit of stuxnet being raised as a c

Except for the ultra slow data extraction part, all other aspects are feasible to a highly motivated state actor. There's a habit of stuxnet being raised as a catchall example of what can be done, but it really was a highly remarkable operation and also answers your second question. They basically infected all the vendors that had access to the airgapped machines for maintenance and got the software onto the machine through someone pluggin in their usb. I think it was said they actually ended up just planting/converting a mole in the vendors during access for more reliability but it's still quite extraordinary