This is a real risk. A colleague of mine who specializes in hardware security research recently received a modified mainboard in an otherwise normal amazon order. The supplier literally modified (with or without their knowledge) the part sent to him by adding an extra unidentified microcontroller that has been soldered into the IO bus. Removing the part caused no loss of performance. It was there for some kind of surveillance OF THE RESEARCHER.
In another case, his air gapped laptop was found to be emitting subaudible tones by modulating the system can.
In another case, his air gapped laptop was found to be emitting subaudible tones by modulating the system can.