Ok, four questions:
1. Is hacking into a foreign AV company by a state an OK thing to do?
2. How do we know the anonymous source is being truthful?
3. If yes to the first two, are we certain that it wasn't exploited but was coerced?
4. If all of these things are true and they were coerced, what is the practical difference for the party being monitored?