Another option is the attacker has those companies "by the balls". They knew that the supply chain was completely compromized, and has been for a while. Admitti

Another option is the attacker has those companies "by the balls". They knew that the supply chain was completely compromized, and has been for a while. Admitting this, after so much time, is financial suicide in the best case. Maybe the companies are even being blackmailed by the attackers. Another twist, maybe someone in the government does not want this to come out officially, because they would be forced to take action against China. On the other hand, maybe this is exactly what the government wants, so they "leak" this information - be it true or false - on purpose. In the end, the world is so messed up currently that every conspiracy theory seems to be equally plausible.