IIRC the documented incidents from the Snowden files were about hardware backdoors/additions added in transit. But they required CISCO to turn a blind eye, at the very least, I think.