People who do not work in hardware seriously underestimate how often counterfeit components enter the supply chain. Even trustworthy distributors like digikey and mouser have had regular cases of their supplies becoming contaminated. It is just way too easy to do and rarely discovered as long as you mix them with enough legitimate components to avoid suspicion. Unless you're unlucky and they happen to reach someone with an affinity for chip photography, the worst case is they'll just think a few components were DOA or out of spec.
It mostly affects low complexity components that are easy to clone so a BMC would be unlikely, but even that is not safe as sometimes used components de-soldered from other products make it back into the supply chain too.
It mostly affects low complexity components that are easy to clone so a BMC would be unlikely, but even that is not safe as sometimes used components de-soldered from other products make it back into the supply chain too.