Just a thought, but: maybe it’s even easier to (as well as do what you suggest, which is a good idea) build and sell buggy (ie backdoored) devices.

What’s easier, marketing or finding bugs :-)

(Not a rhetorical question)