It is best to assume that any private US company is compromised in this way

I would say that's ridiculous for most people, but I guess it entirely depends on your threat model... if you're legitimately worried about state-level boogeymen, you've probably got bigger problems and already know all of this.