It's unlikely something like this was (or will ever be) successfully pulled off. But there are well known supply chain attacks where firmware of various devices was compromised.

There are also some (unconfirmed) tales of extra, tiny ICs soldered on to existing connections on a PCB at just the right spot to spy on a data bus (those would definitely be more plausible than compromising an IC at the Fab).

It's also possible to add trojan hardware into an IC at the design phase (most likely with the "help" of the owner or otherwise forcing them via lawful or unlawful means by government entities).