CryptoBilis again.
They were sold a short time before all of these supply chain attacks with an NDA for the sellers not to disclose that the company was sold.
Now at least two different hardware wallet manufacturers have been hit with the same supply chain attack. No other companies have been found selling wallets with these implants.
This makes me think it's CryptoBilis itself that is responsible for these attacks.