The document covers how they put a good amount of effort into ensuring there's not a clear link back to the CIA or relevant parties if one of these things is discovered. I imagine having hardware level vulnerabilities would much more quickly point directly to the only agencies capable of such techniques.
That's sort of my point though. If hardware back doors exist (and I don't argue that they can't!) they're exotic, highly protected and rarely used. They aren't routine instruments of state surveillance.
