You have no idea what you're talking about mate. As a state-level actor, I could obtain/develop a nice Safari root exploit and get the target to visit a malicious site. Heck, if I were the NSA, I could probably get Facebook to insert the exploit payload once the target logs in. Game over.