These attacks are also incredibly loud. Many attackers are motivated to operate very quietly. We haven't seen any tradecraft from these machines, it's all noisy and bombastic.

When we see them mount a quiet backdooring campaign, like the XZ-SSH attack, or something like Stuxnet, then we'll have real problems.