Very. These companies pay good money for 0 days and invest considerable effort into finding their own. Also these attacks are aimed at individuals and executed

Very. These companies pay good money for 0 days and invest considerable effort into finding their own. Also these attacks are aimed at individuals and executed by state actors. They likely already knew what phone, OS, and browser the MEP was using and selected an appropriate attack from the catalog.