There are far more advanced hacking groups than there are nation states. There are likely more criminal hacking groups in each individual country than there are nation states.
If you have some examples of criminal groups using zero days in hard targets, I'm very interested. From what I see, no one's mobile phones are getting hit with ransomware via fresh vulns. That behavior is generally reserved for nation states with the ability (financial and legal) to purchase the exploits.