iPhone exploits are cheap enough that you don't need to be a state actor to have access to them. Heck the app store review process hardly even instruments the apps so you can just ship semi targeted malware that way.