the question highlights how ill-suited the 'spy agencies'​​ are for conducting asymmetric anything.

Unless they had a Brain inside think of a mechanism and explain it to an Engineer to propose to a Facilities Security Manager who obtained confirmation from a Director, they would be vulnerable.

For instance, TEMPEST security - every SCIF has it because inside it was well documented/implemented.  SEISMIC security - no SCIF*** is isolated from seismic vibrations modulated with data.  So, to ex-filtrate data, have those passing circus elephants stomp their feet in predetermined patterns.  Or make one of those "Dune" style thumpers.  The worms in this case being .... ?

*** I'm suppose some very few SCIFs are vibration isolated for various reasons, but not as an exfil channel.

-daniel