If one looks at the backdoor placed in Dual-EC - or in type of backdoor engineered into this SHA1 variant (https://malicioussha1.github.io/doc/malsha1_lv.pdf ht

If one looks at the backdoor placed in Dual-EC - or in type of backdoor engineered into this SHA1 variant (https://malicioussha1.github.io/doc/malsha1_lv.pdf https://malicioussha1.github.io/doc/malsha1_lv.pdf) - there are ways to provide a backdoor such that it is cryptographically hard to attack for anyone but the designer (NSA, etc). The NSA has a term for these types of backdoors: NOBUS. Nobody But Us. Schneier calls this idea silly, but the principle is sound if there are cryptographic garuntees behind the backdoor (like above examples). Backdoors in code are less likely to be NOBUS.