“State-sponsored threats like Volt Typhoon and Salt Typhoon exploit software vulnerabilities that customers have failed to patch in a timely manner.”