The risk is not the quality of the work that the person might do. The risk is that you now have a state-controlled North Korean asset operating inside your security perimeter.
That's why there's no one industry or types of businesses being targeted, it's anywhere they can get hired. If your a high profile target, that's a bonus not the original goal.
Hiring mischievous North Koreans is fully in line with your CIO's new priorities, which she heard about at a conference once.