"The rewards of this category of attack must be much higher than easier attacks for the significantly higher costs and risks to be justified." But obviously the rewards ARE massively higher; the potential reward from compromising the (especially firmware) supply chains of the top 3 or 4 hardware wallet manufacturers are massive, they must be at least comparable with the biggest exchange thefts we've had. Saying it's "limited to organized crime/govts", meh, maybe maybe not but is that OK then? NK have been on the case for over half a decade now, with many great successes.