[Swordmaker]

If it sat on a number of Macs for 5 to 10 years undetected, it is sophisticated enough.

No, it speaks of the users of those Macs lack of sophistication rather than the sophistication of the malware. . . and the lack of the malware's apparent intrusiveness. . . the users just did not notice it, nor did it make itself apparent by untoward activity.

[Dr. Sivana]

No, it speaks of the users of those Macs lack of sophistication rather than the sophistication of the malware. . . and the lack of the malware's apparent intrusiveness. . . the users just did not notice it, nor did it make itself apparent by untoward activity.

Depending on the target, the sophistication of the users is irrelevant if we are going to have "personal" computers at all. In this case it mentioned a number of the users were "researchers". While they might not be UT researchers, they would likely have above average intelligence and understanding of how technology works. If the malware did what the malefactorous author(s) intended, it was sophisticated enough. Q.E.D.