Trust me, I know all of this, I am not some random nobody. I am going to go over what you have here though.
Yes, you can write a program to steal my auth token, however any reasonably well secured website will make that token useless to anyone except the person that needs the auth token. There are many ways todo this.
He could not plug Stuxnet into any computer and it would wreck havoc on anything. Stuxnet was a very specialized program meant to run on a specialized environment and to my knowledge doesn't even activate outside of that environment
No one can install spyware undetectably, if its there its detectable. It either has to store the information which can detected or it has to be transmitted which can be detected and certainly the operations it uses to scrape the information is detectable.
Xkeyscore is a glorified search algorithm. is it scary the government created this thing, sure but that doesn't make it any less than that.
Why the hell does it matter they can map my floor plan? if they wanted my floor plan they could easily get a warrant for the house from the local government office without any trouble or me knowing. Further more it doesn't really matter they can map my house because what are they going todo with data that IS ALREADY PUBLIC DUE TO BUILDING REGULATIONS
Yes every email I have sent outside of my internal company emails that never hit the internet or my personal server to personal server emails is stored in its encrypted and likely unencryptable form for the foreseeable future on some government computer. Good for them, they might even have my phone calls and text and internet history but as time has shown they have so much information that they themselves can't even search it. So I congratz them for doing one of the most useless information gathering sessions in the history of the world that will soon be outed.