I forget who it was but I remember someone commenting along the lines of: They don't need to add back doors they just need poor security. Or, to double paraphrase. Any sufficiently bad firmware is indistinguishable from back doored.