The key word being "mercenary", which does not rule out first-party spyware.
- can give away your data for free - get hacked by nation-state such as Iran - get hacked by mercenary spyware and not notice
and their statement would still be correct. Now that's an awful lot of qualifiers. Plus that's just what they say.