I've always assumed if you are a high-value target and a state-level actor, or a sufficiently motivated private entity, knows where high value hardware is being

I've always assumed if you are a high-value target and a state-level actor, or a sufficiently motivated private entity, knows where high value hardware is being manufactured, or dispatched from, you ought to assume your security is already hosed. Either because they've simply tracked the delivery or tampered with it. Are we to assume the CIA and it's ilk don't have operatives inside these organisations? Of course, if you're sufficiently organised, you'd have low level grunts take on all the risk. Or did staying up for way too long selling meth-amphetamine for the better part of a decade make me way too paranoid?