The further you are removed from the end product, the harder it is to perform targeted attacks. Sure, they could build a backdoor into every component they prod

The further you are removed from the end product, the harder it is to perform targeted attacks. Sure, they could build a backdoor into every component they produce and hope it won't go detected, but the possibility of the subversion being detected scales linearly with the occurrence rate. And if they only subvert 1 in 1000 chips, how are they going to ensure those chips end up at their intended targets? How hard would be for the Chinese or Russians to pay an employee to slip some compromised chips to pick and place machine? Probably some orders of magnitude harder than if it were assembled in China.