They implant backdoors and sell zero-click RCEs that exploit those backdoors.

That's a pretty strong claim. Do you have any evidence they have done this?

And i mean, i'm genuinely curious. I don't think they would be above doing so if they had the opportunity, i just haven't heard of any instances where they were caught doing so.

I’m not sure why you’re making that point; the exploit we are talking about _is_ an RCE.

The person i was replying to claimed that countries like usa rely on hardware modification while countries like israel rely on back-doors. This does not seem to be the case. Israel doesn't (or at least hasn't been caught) making backdoors, while the usa actually has (e.g. Dual_EG).

RCE is a broad category and includes many things. That said, while technically the liblzma thing is an RCE, supply chain attacks aren't really what most people mean when they talk about an RCE vulnerability.