Absolutely can be done. But what I keep saying is it's not easy or cheap. Most of the hypotheticals being discussed here would require the resources a major military/intel organization.

So not worth losing a lot of sleep over, but don't kid yourself that it can never become an issue.

Worth noting that many or most cyber warfare capabilities are developed and then shelved until really needed. It's often the case that these capabilities are "one shot", in that employing them will cause the adversary to close the access mechanism or otherwise defend himself against subsequent attacks. That's why they are typically so highly classified; the very knowledge that they exist would render them useless...kind of a waste of money.