Kernel contributors aren't background-checked so all you need to do is to pay someone to do some legitimate kernel hacking in a sensitive area. Then in one of their commits slip in a backdoor.
"But noooo the many eyes will see the backdoor!" you say.
This is clearly false. If it were true Linux would have no security bugs at all. Since old security bugs continue to be found, it follows that it is possible to have a security bug that goes unnoticed for many years. See also the underhanded C contest.
Hell maybe it has already happened. Who is to say the latest Linux security bug wasn't deliberately introduced by the NSA?
I don't think this is paranoia - it would be fairly easy for the NSA to do, very useful and almost completely deniable. I would do it if I were them. They certainly wouldn't not do it for moral reasons because they've shown they don't really have any.