Compromising hardware doesn’t require compromising countries.

If you’re servers are worth X Billion Dollars that’s attractive to the same sorts of criminals that rob banks. Hell governments have a long history of running drugs and state sanctioned piracy etc. An attractive enough target needs serious security.