It doesn't even have to be a state actor but it isn't as simple as "at will" a compromise requires effort and resources and discovery would be attributed back to the actor. Willful access has none of that problem.