Some would say that this is a tactic by players like the NSO Group to drown real vulnerabilities in spam.

It’s not unlikely. Not unlikely at all.