>all the US needs to do is have Microsoft, Google, or whatever tech company is in control of a system of interest to insert malware or give the US government the private data it requests

Don't even need that. Just utilize one of the numerous vulnerabilities before it's patched.