> In that case why didn't they remotely disable Snowden's laptop when he went on the run?

There are several possible answers to that question:

1) "Just because you're paranoid doesn't mean they're not after you."

2) Because the risk of getting this backdoor known would not be worth the cost.

3) Because Snowden's laptop was used with airgap.

4) Because at that point, the cat was already out of the bag (the journalists had the data on SDs).

What would NSA spooks have achieved besides confirming that hardware backdoor are real (to those remaining few who still doubt)? Snowden could have simply took out HDD, put in into the new machine and resume his operation.

The ME has full control of the hardware and could have wiped the hard drive before bricking the machine. The NSA presumably would have preferred a bit of bad PR to actual classified information being leaked. A better argument would be that all laptops approved for use by NSA staff routinely have the HAP bit enabled.

I somehow suspect that Snowden was smart enough not to keep all eggs in a single basket. His laptop might as well has been mugged or stolen.

My guess is that with insider knowledge and a good firewall, a no-updates policy you can prevent phoning into the backdoor for a while.