@soatok gods, don't fucking get me started on people and their completely delusional threat models and even more delusional 'responses.'
"We're targeted by state actors!"
Yes. We are.
"So we need to do all of STIG! All of it!! That will protect us!!"
... it absolutely will fucking not.
IF a real state or state-sponsored actor wants in, they WILL get in. If you're trying to use purely technical means to defend, you already failed, and will continue to fail.