These attacks are easily done because a lot of people assume new hardware in bubble wrap is secure and wasn’t altered. There are many stories of intelligence agencies bugging the hardware after you order it, specifically online, and no, those aren’t some tinfoil hat thinking, they are actively doing it incl Europe, so always buy your device randomly from some local store and pick it up immediately, or buy it used, better yet, if you have some electronics knowledge is checking it yourself.