Earlier quoted context omitted.
If anything, not paranoid enough because still tracking. This place would be one of the best to hit with a 0day. Lots of IT people with full admin rights to entire corporate networks.
Doesn't fit the risk profile. 0days are used with surgical precision, not simply to dunk on hundreds of random businesses.
Users at XYZ.gov gets the 0day, everyone else gets what is expected.