How hard would it be for the Russian or Chinese governments to install one of their top programmers into a high-value target like Google, Facebook, Slack, etc a

How hard would it be for the Russian or Chinese governments to install one of their top programmers into a high-value target like Google, Facebook, Slack, etc and have them introduce subtle bugs that could be used to crack into the private data? If they're not doing this right now I would be shocked.