There are zero days in every piece of software, but malware is already mostly a state-actor-only thing.