I’m not sure you’re right.

As soon as this kind of stuff gets a simple binary that an attacker can drop on the system, they could definitely add it to their arsenal.

There’s many different state actors working on this kind of stuff. I’m sure there’s a separation between teams that make tools such as these and the ones using them.