Reminds me of that time when state actors wanted to spread the Stuxnet worm into an air gapped nucleair facility in Iran, and basically hijacked the whole USB supply chain and put the worm in there.

When enough resources / money is involved, these things are to be expected.