I agree. I think state actors obviously have much stronger technical capabilities and can operate with impunity, but a motivated actor can certainly achieve nef

I agree. I think state actors obviously have much stronger technical capabilities and can operate with impunity, but a motivated actor can certainly achieve nefarious ends in most cases. Especially against a large public website where the attack surface is massive and the potential of a breach would provide a wealth of privileged information that would provide substantial motivation.