On one hand, zero days are rare and expensive.
OTOH someone who isn't the CEO of a major company might not notice the malware, or if they do, not know they should forward it to an organization like Citizen Lab.
Zero days are expensive for individuals and small companies, but what happens when state actors are involved?
That's what I am questioning.
There are many sysadmins, key executives in tech companies, or open source contributors who may not be "high profile" in the traditional sense but be juicy targets. Arguably there are more useful targets to hack than a CEO who's assuming their every move is being studied and always keeps truly sensitive conversations verbal.
really?
You use zero, someone notice, it gets fixed.
And yes, they are rare compared to the vast # of known vulns.
Ideally if given the choice, you'd utilize a known vuln against outdated software rather than risk burning your zero day.