Too easy to blame so mysterious entity when you are too lazy to actually ID the cause of the leak.
They assume state actor due to the perceived strength of their own encryption etc. thinking that only a state actor has the ability to break into their systems given the expense of the needed computing power. This is a stupid assumption.
It is like blaming evil spirits for an unknown disease. Just plain intellectually lazy