Of course, I am ignoring the proprietary tool chains in all of this. But again that depends on being able to find interesting stuff in your IP to backdoor. I would recommend using vendor IP as little as possible.

Don't use a vendor Ethernet module! I could see that as a great place to attach a scan-chain backdoor.