Finding/buying a zero day exploit is what most SIGINT intelligence organizations around the world could more or less easily achieve.
Penetrating an organization to the point of being able to introduce foreign code into their products which remained there for at least several years, as well as launch a fairly sophisticated crypto attack which would only benefit some one if they had the ability to tap into large scale internet traffic isn't something that many organizations if at all outside of the NSA-GCHQ coop should be able to achieve.
Russia and China are quite far behind, Germany and France don't have the budget (as far as appropriations goes, if they wanted too they could surely find the money), Israel could pull the exploit off both technically and operationally but it most likely lacks the ability to gather internet traffic on wide scale (it is probably one of the best out there as far as wireless sigint goes but it lacks the resources to be able to tap into world wide internet cable infrastructure) which makes it unlikely that they would introduce the VPN backdoor (unless it was for a very specific target, although Juniper together with ZTE pretty much rule the Iranian ISP market). This either means that either Russia and China are playing way beyond their presumed level of both capability and competency or there are other players most likely private hanging around the court which should is even more frightening.
Ofcourse there's still a chance that the NSA not only knew about those backdoors but actually introduce them but at the time being all the supportive documents just show that they discovered them rather than introduced them.