Because it's likely a state did this.

> In an interview with Reuters, FireEye CEO Dave DeWalt said, "That feat is only able to be obtained by a handful of nation-state actors." In any event, there's no doubt that the devices were infected by a professionally developed and fully featured backdoor.