It's possible, but not likely. Targeting proprietary, commercial vendors is probably a lot easier than open source, as it's much easier to hide what you're doing. And many more of the targets they are trying to attack are likely buying fully supported solutions from commercial vendors, not COTS hardware and installing open-source software themselves.

Even for open source software, it would be easier to just target the integrator, such as the binary packages provided by the distro or preinstalled on hardware by a system integrator, rather than introducing vulnerabilities or causing problems in the upstream open source project.

Considering that such an approach would be a lot cheaper than nearly any other, I'd say of course it's happening. Imagine offering someone the Google salary that Google will pay plus pay from NSA and all the pension benefits, etc.

i was thinking the exact same thing .. this seems like a very reasonable approach