So in essence they

- can give away your data for free - get hacked by nation-state such as Iran - get hacked by mercenary spyware and not notice

and their statement would still be correct. Now that's an awful lot of qualifiers. Plus that's just what they say.

Mercenary also excludes people do it for funsies and not getting paid.

Does it also exclude researchers?

Only if they keep refusing to pay bug bounties!

The wording is weird enough that I have to agree. This is the first time I've ever heard spyware segmented using "mercenary" as a qualifier, which is just insanely suspicious.