The State is commoditizing exploits and has been for a long time. They have special contract vehicles for buying the tech from private sector to be tailor made for specific use cases. The State will also purchase entire "companies" to be honeypots for bad actors to target. Or to obfuscate their involvement.  

 As seen with ANOM

DON'T USE SOMETHING THAT MARKETS ITSELF OPENLY TO CRIMINALS 

 If you can't self host it, you can't know it's not a honeypot.  

 Is GrapheneOS legit? How about their auditor server? 

 Good question.