Good social engineering is a lot harder to do than 90% of online hacks, which are generally just skiddies downloading some PoCs from GitHub and spamming them until they get results.
The Project Zero and APT type stuff that hits the news is the exception, not the rule, which is why it hits the news in the first place.
False. Social engineering has the same equivalent concept of script kiddies, just con artists who are reusing well-known types of patter/cons to be able to exploit age old evolutionary psychological vulnerabilities in humans that unlike computers, we are not able to easily patch.
The Project Zero and APT type stuff that hits the news is the exception, not the rule, which is why it hits the news in the first place.