There’s one thing I don’t understand with this “state sponsored actor”. Say you are an oppressive regime and you target activists who use yahoo mail to publish your dirty laundry. Why on earth would you hack half a billion accounts just to get access to a few dozen ones? Doesn’t make sense. You attract too much attention. A thing like that would never go unnoticed. If on the other hand you’ve found some exploit and target specific accounts which are numbered in the tens, say hundreds, you can easily get away with it.

BTW, I don’t know if it’s coincidental but just yesterday I received a notification from Yahoo to disable access to Mail from third party apps.