This isn't script-kiddie level hacking. There were considerable resources spend to develop those exploits, probably by a nation state. Those actors not being able to get an untraceable CCs/identities is highly unlikely.
For a 3 letter agency, legal issues might be the bigger hurdle. E.g. you might have to make sure the data passing though the CDN and thus CDN itself isn't in some other justification when spying on your own cities.
For a 3 letter agency, legal issues might be the bigger hurdle. E.g. you might have to make sure the data passing though the CDN and thus CDN itself isn't in some other justification when spying on your own cities.