Maybe they were forced to do so, which is a lot worse IMO because they kept it silent instead of being transparent about the situation. Who knows what other backdoors they've already introduced or could introduce in the future into their project.