Yeah malware is everywhere - This could simply be a product of an individual actor abusing their position in a supply chain.... but this also goes for hardware as well. It is certainly a more difficult vector to attack from but due to its 'level' it's a valuable position to compromise.