Shodan [1] is not the only place active vulnerabilities are stored up. Each nation have systems that track vulnerabilities and scripts can be stored up to mass exploit all these systems all at once. And that is just for internet facing crap. There are also systems designed to be weak. Anything with SSH default settings especially multiplexing and sudo with weakened lazy settings such as passwordless or passwordless with timeouts are easy targets for phishing and establishing a RAT without any additional software meaning no malware is required, no bugs are required and nothing would be detected, ever. The existing state of the internet was not designed to handle nation state level attacks and fixing that requires adding friction that people simply will not accept. It's a hackers paradise.

TL;DR The biggest weakness of the internet is human nature.

[1] - https://www.shodan.io/