So in essence they

- can give away your data for free - get hacked by nation-state such as Iran - get hacked by mercenary spyware and not notice

and their statement would still be correct. Now that's an awful lot of qualifiers. Plus that's just what they say.

Mercenary also excludes people do it for funsies and not getting paid.