Is the risk of state-sponsored actors overhyped?

I've been seeing a lot of stories about breaches coming from groups "affiliated with" various foreign governments ([like this one](https://thehackernews.com/2023/09/lazarus-group-impersonates-recruiter.html?utm_source=Email&utm_medium=Macro&utm_campaign=S01&utm_content=2023-10-03)) but this narrative leaves me with a couple questions:

1. Are all these groups are really sponsored by the governments of these countries or are they merely operating out of these countries (potentially with some level of benign neglect from the people in charge, a la privateers)? Whose word are we going by when we call them state-sponsored/affiliated?
2. How …

call charge countries cybersecurity people privateers sponsored stack state threat word