Intelligence agencies are a lot more likely to be using illegal malware than law enforcement. Criminals are actually pretty far down the list of people who should be concerned.

Think political dissidents and groups that support them like citizenlab.org, people working on classified projects - or with geopolitcally important trade secrets (which is actually a pretty broad range), members of the military in times of war - or when working with classified information/going to classified locations, people susceptible to being blackmailed with things like nudes of themselves, and so on and so forth.