I found an XSS on FireEye's website when I was a pentester. Good times.. It took all night, too. Was worried it'd be the first gig I wasn't able to get a medium severity on.

I'm not sure anything can protect against a targeted attack from a nation-state. It's tempting to think that you can. But the warfare is asymmetric; they have all the time in the world to become certain that they can breach your outer defenses. One slip up, one old server version, is all it takes. I've seen it.

In this case, it's a security company, so I'm sure the irony seems a bit thick. But it's helpful to recall that security companies are companies. And no one is immune to security threats.