The point about scale, is that if this happened at the scale that is being claimed, it shouldn't be too hard to find a compromised unit.
The scale being claimed is a mere four factories, subcontractors of Supermicro's actual contractors, who were only used when demand exceeded those contractors' own capabilities.