Well people are sending suspicious files to the AV vendors all the time, so Symantec may have found the backdoor a lot later and then found it existing in their DBs.