There are a few ways this is dealt with in government. First is a requirement to provide engineering diagrams sufficient to rebuild a chip from scratch if neces

There are a few ways this is dealt with in government. First is a requirement to provide engineering diagrams sufficient to rebuild a chip from scratch if necessary. When purchasing a few hundred thousand servers at a time from Dell or leasing space in Amazon's data centers, nobody is physically auditing that every chip actually matches the diagram, but they will randomly audit at least a few. If someone is shipping a bunch of motherboards that have undocumented backdoors on them, it will get noticed. Second is network disconnection of the systems. Most exploits rely on remote access. If there is no network path from a C&C server to the infected host due to it not being exposed to the Internet and not having any kind of commodity radio capability, there isn't much an attacker can do short of something like Stuxnet, that is, just frying machinery instead of trying to exfil data or take over control. Something like that needs to be pretty tightly targeted, though. The factory line in China likely doesn't have any reliable way to identify exactly which chips are going to end up in US critical systems and only sabotage those. Third is extremely thorough sandbox testing. Observe something for a long time in a controlled environment and see what it does. That is also something that is not feasible to do for every part, but it is feasible and is done for randomly selected equipment samples. Obviously, different levels of scrutiny, testing, and security will be applied to, say, the public homepage of the Department of Labor versus the servers running blue force tracking for operational military units. In some ways, it is actually a lot easier to secure critical defense and IC systems than something like banking or email. Not having to expose an information system to external networks or allow arbitrary users signup access is already a huge first step that simplifies the problem space a ton.