With a staged payload, the ability to communicate across an airgap could allow successive stages to be delivered in the presence of counter-measures. It could also facilitate minimization of the spore's footprint during initial infection and thereby reduce the likelihood that the spore will be detected.

The conclusion that for communications across the air-gap to work, the receiver must already be infected is the only alternative to "No, it isn't happening."

Now I'm not in a position to say, that it is happening. But I'm not in a position to say that the supply chain for electronic devices is hardened against an attack by a state sponsored agency seeking to inject spores into devices at the time of manufacture. If an agency is interested in maximizing backdoor accesses, having infected devices roll off the assembly line and straight to end users certainly seems like an ideal outcome. It's map reduce.

Don't get me wrong, I know I'm furiously folding Reynolds Wrap. But I also know that there is a cognitive gap between the furniture of everyday experience and large scale phenomena - e.g. collecting meta data on all phone calls simultaneously and then storing and searching it doesn't fit with the MOS 6510 mental model of computing I habitually use.