Given sufficient motivation the little snitch dev could essentially supply chain attack every user, or even specific users.

Said motivation could be a nation state handing them $XXX million dollars

Well, that is obvious, is it not? It means They are interested in The Plan and have enough power that a vague comment is all you gonna get. Cannot have Them finding out that we are on to Them. Though of course, The Plan already accounts for that, so They already know and will do Something about it. Want facts? Wake up, do your Research!