Given the size estimation, it wouldn’t cover the whole footprint.

But... why put it on an unpopulated footprint. Why not just replace the original Quad SPI IC with a backdoored device?