content: The part you missed that is potentially more scary is that the exploit is low level. It could be manufactured into components by a nation that produces the electronics. Probably we could think of one or two such countries that produce lots of electronics and that are very active in cyber warfare. Even if your employees strictly adhere to rules about flash drives and smart phones, air gapped computers could be compromised, and dumb phones could be listening. I agree that it seems pretty unlikely. But then again STUXNET was apparently custom made to screw up a specific Iranian centrifuge facility. In the 80s, the US government supposedly also blew up a Soviet pipeline by sabotaging control system software. Government actors are capable of a lot.