Yeah, well, when was the last time common people and business paid attention to IT Security experts BEFORE their systems were broken into?!

Also, who would pay the people with the necessary expertise to decompile all BIOS of all motherboard shipments (if at all possible, in this day and age when a lot of shit is encrypted with the keys inside a TPM module)?

I mean, just go at it another way - notice how thousands of pager sent to Lebanon were altered by the Israelis and nobody were aware of it until the Israelis made them explode.

In this day and age it's pretty straightforward to just alter the software for some shipments and not others or add a weakness (like both Intel and AMD CPUs have) that can be used as a backdoor by software that's installed remotely (for example, pushed as a Windows update, something which certain American 3 letter agencies can most certainly do since the have the power to demand the signing keys from MS).

There are huge numbers of vectors for spyware to end up in certain computers that start with subtly backdooring the hardware itself.