The NSA can probably compromise software easier than hardware. Even for open source, enterprise and telco customers will be using official builds (by which I mean officially NSA-compromised).