[Edman274]

Are we just straight up ignoring the Jia Tan xz exploit that happened 10 months ago that would've granted ssh access to the majority of servers running OpenSSH?, or does that not count for the purposes of this question, because that was an open source library rather than a hardware manufacturer?

[pvg]

Is there any evidence the author of this backdoor was able to sell it to anyone, for any kind of money?