Zuckerberg basically is the nation state we should be worried about. If a foreign country wants to spy on someone, they'll do it via a Facebook pixel.

Yep. When the Saudi government wanted to persecute dissidents and journalists, they went to the service providers to get compromising info on them. They just paid employees at the companies that didn't play ball to siphon data and target people clandestinely.