Everything has a vulnerability that Solarwinds hasn't disclosed. What is the logic in focusing on this extremely unique choice? A plan by a government wants to spearfish developers at every enterprise software company to find 1+ ways in to their clients and should have chosen something universal. Without any apparent data, it seems more likely the suspicion is just speculation because it is less common than email clients, legacy browsers, dev-servers, common libraries, etc.

I.e. because no one else found this intruder the crap software that everyone uses must be safe?