Even if, well... some intelligence service has developed microcode-level "implants"/malware, they wouldn't necessarily want it to be part of the standard build that gets shipped to all customers, precisely because of the risk of exposure. It's at least as likely that they'd install it on targets as updates, having first secured access by other means (as they'd have to anyway to exploit a backdoor that did ship with the chips). It's possible that some agencies would even be able to access signing keys if that helped simplify "implanting" procedures -- though it might not be necessary, if (like the OPs here) they can arrange microcode-level execution by other means.