I wonder how Apple decides who to inform and who not to when they detect malware like pegasus. Good they did inform a person in question. However, what if this

I wonder how Apple decides who to inform and who not to when they detect malware like pegasus. Good they did inform a person in question. However, what if this person was much lower profile? Let's say a person that lives in a democratic country. Does Apple even know who targeted them? If they do, let's say "if its China or Russia" we inform. Then what if China or Russia does the exact same thing but using a paid agent in a democratic country? This raises so many questions. And finally, if Apple can detect such malware why isn't there an immediate notification from some local app? Like an anti virus for your phone. They must already have something like this, otherwise how would they know?