This isn't the first time that application has had problems either, the CIA hacked it because it was loading unsigned DLLs: https://notepad-plus-plus.org/news/v733-fix-cia-hacking-npp-issue/
To be fair it's one of the most popular text editors so it's not surprising nation states would target them, and it's hard to block someone with those kinds of resources.