To be fair, the stuff you are talking about is targeted malware. The odds of people being actively targeted rather than passively surveilled is orders of magnitude in difference.

Everyone is being passively watched at some level, even if it is just for billing purposes.

Defense is always about defense in depth. Always.