I feel like the CIA is much more likely to inject JavaScript to attack your browser because it’s more flexible and provides a complex and attacker-exposed interface to browser features.
On the other hand, they probably have back doors to everything, so what do I know?
Wouldn't be surprising if they got hardware backdoors in a bunch of the common semiconductors. Who could find out if Intel Management Engine or AMD equivalent was doing something sus. If I were the CIA/NSA I'd definitely be thinking of ways to repeat and surpass the Crypto AG success story.