I think those are designed to avoid detection, so they (having near-unlimited budgets for these sorts of covert things) prefer to go with replacement firmwares and suchlike. They've been known to intercept packages of networking equipment and do all-software implants so that you can't even tell a device has been tampered by looking at it, and if they want to exit they can remove all traces that they were there. Leaving physical hardware in place is the opposite of that.

There are so many places to hide malicious code in any computer or networking system these days, using weird nonstandard obvious hardware like this is pretty amateur.