As always, a chain is only as strong as its weakest link. If hacking an antivirus will gain the attacker complete control over millions of potential targets, t

As always, a chain is only as strong as its weakest link. If hacking an antivirus will gain the attacker complete control over millions of potential targets, than the weakest link in millions of machines is also a bug in that antivirus software. There is a reason many experts recommending against installing anything besides Defender. In retrospect, Solarwinds seems to have been a relatively weak link, but perhaps no less than Microsoft teams or other common enterprise software that are known to take security lightly. And of course, less than any IoT device that might be practical to attack en masse. These will continue to be targeted, and it is silly to say that anyone is "breaking norms".