I think the who question is not so much about determining exactly who might attack you. Its about thinking what types of threat actor you might be exposed to.

I think the who question is not so much about determining exactly who might attack you. Its about thinking what types of threat actor you might be exposed to. They all have different motivations and capabilities and resources. This can help you determine if it's worth trying to mitigate certain kinds of attack path, and how likely it is you may be exposed to them. You can do threat modelling without considering threat actors and just focus on attack paths and asset values to prioritise or rule out any mitigations as well. At the end of the day, there is no one true way to do threat modelling. Everyone has a slightly different approach. I'd say do what works for you, but be open to other approaches.