[phire]

Or just replace one of the existing chips on the i2c bus with an identical but malicious one.

I don't know how you would even detect that, short of decapping and scanning the die in.

[mianos]

That would be as easy as getting a same sized chip that is, say, an attiny, a bit of sand-papering and a laser to re-etch the package. If you had access to a wire bonding machine, not difficult, you could mount a second die in a de-capped package and cap it up with a bit of black resin. This would not require state level actors. Bunny Huang type of guys could do it.