[drdaeman]

I believe most AV vendors, if/when persuaded by powerful agencies, won't need to introduce an specially crafted backdoor.

An average antivirus software has everything necessary already. Personal licenses as a way to identify the specific machine or person, automatic streaming software updates as a way to deliver the payload and almost unrestricted privileges on the target system enough to infiltrate and stay concealed.