It's entirely plausible as long as no one is inspecting the final product. The hard part isn't connecting the traces, it's doing so without immediately arousing

It's entirely plausible as long as no one is inspecting the final product. The hard part isn't connecting the traces, it's doing so without immediately arousing suspicion when a tech open the server and sees a ghetto engineered chip hanging off the PCB at a weird angle. I hadn't read the detail about the second flash chip. Obviously, if they're just putting compromised flash into a footprint left empty by the manufacturer on purpose for recovery, it's much easier, cleaner, and can be done with a small group.