Yes, it's an attractive place to add surveillance code for all NICs. But not all NICs take over encryption/decryption. And if other components do the encryption

Yes, it's an attractive place to add surveillance code for all NICs. But not all NICs take over encryption/decryption. And if other components do the encryption/decryption, NICs don't see plaintext - just (lots of) metadata. If/when they take over encryption/decryption functions, that would make them an even better place for hard-to-detect, user-disloyal surveillance code.