[avian]

As a part of a highly targeted attack on a single device, maybe. It would have to involve specialist knowledge and manual work to do it. For example, something simple like sabotaging a "mic on" or "camera on" LED on might be possible on a complicated design without anyone noticing for a while. Seems a lot of work for little effect though.

Blanket automated modifying of hardware designs to add "spyware in hardware form"? I would say even "automated" part is impossible at the moment. I've never heard of automation that would understand a hardware design on a level that would be required for that.

In the end, the only modification with a good chance of being missed by the designer is the copper artwork on existing PCB layers. You might add an extra trace, or break an existing trace somewhere. But as soon as your hacked Kicad starts adding BOM items (like an extra "spyware" microprocessor or something) or even extra layers, I guarantee someone is going to notice very soon. If not for other reasons then because these things will add extra $ on someone's bill.