It's probably more subtle than that: coreboot is a hodgepodge of open source aspects and oblique blobs that contain god knows what. That's why libreboot exists

It's probably more subtle than that: coreboot is a hodgepodge of open source aspects and oblique blobs that contain god knows what. That's why libreboot exists (shares a lot of coreboot code but doesn't allow blobs). If the NSA wants to do some dirt, then the dirt will probably go into the blobs and/or happen as a result of how the open source code interacts with the blobs in ways that are not obvious to anyone who doesn't know what's in the blobs. So I can see how getting some influence in the coreboot community would be of strategic value to them to implement schemes to weaken IT security for whoever they want to weaken it for.