I feel like this is kind of the amateur-hour stuff. It’s certainly dangerous, but in comparison to a lot of state-actor activities (or even committed-amateur activities), this kind of supply-chain attack is pretty blatant and easy to spot. Which doesn’t mean it’s easy to spot

the real worrisome stuff comes from state actors who know what they're doing and have captured the entire ecosystem to prevent it from being discovered until it doesn't matter any more. eg stuxnet, prism, etc.