State sponsored hackers are a very small percentage of the threat actors out there. Also - they don't need to exploit a zero day if you are willingly launching something on your machine.