What about Quality Control
Having worked in the industry on thing pops out at me. Supposedly security agencies caught this. All production has Quality Control. Visual inspection is done, at least on a spot check basis. One checks to see if there are any parts that have fallen of during manufacturing, shock and vibe. A missing capacitor, no matter how small would be caught. Given that this happens, any extra chip would also be flagged by Quality Control. I could see quality control catching this and forwarding the issue to security agencies, not the other way around.
To add this chip it would have to be to intercept the board in shipment ad replace it, not in manufacturing. This seems like a very unlikely scenario to me and therefore I lean towards Super Micro, Apple, and Amazon statements being more credible.