With a technical field, though, you have the added constraint that you need people who are familiar with the technology involved. At the low-level infrastructure level of a company like Google or Facebook, that might number in the dozens-to-hundreds - not exactly a huge pool to choose from, particularly when implementation will require quite a few people. And you need someone to do the choosing who can both be trusted by the government and knows all the people with the relevant technical skills.

There's also the issue of how to hide the source code (to my knowledge, both Google and Facebook use one source repository for the whole company, to which virtually everyone has access). This can be gotten around - I'm sure that there are private repositories off to the side that you could use to build a binary - but this is yet another integration point that could be discovered. (Eg. some SRE notices that network bandwidth is high for a DC, traces it to a machine, notices the machine is consuming a large amount of CPU, gets root and runs 'top', and suddenly notices an unknown process siphoning off all data. At this point, how could they not assume their network is being attacked - because that's really what this is, the U.S. government hacking into the company's DCs - and pull the alarm? So all the SREs, abuse teams, internal security, etc. would have to be briefed, which is small compared to the whole company but still a huge surface area for a top-secret project.)