Sure.

First, Canada doesn't have that much manpower on it. CSE only has around 2000 people, only a fraction of whom work on SIGINT, and again only fraction of whom work on technical CNE. There is a significant work cost to attacking even a single target, in particular because exploit tools lose value when used and have to be modified or re-developed.

Second, attacks on non-government entities have a likelihood of eventually becoming public because they are subject to private digital forensic investigation. I only know of one case of a compromise of a non-government target that likely originated from a western intelligence agency (Stuxnet), which makes it unlikely that they are frequent.

Third, it usually wouldn't be legal. There are laws that both permit and limit CSE's SIGINT activities, and attacks have to be squared with those laws. There have been questions about whether the oversight is adequate, but it does exist.