"Obviously such attacks are possible, but are they likely? I can see how the cat-and-mouse game of IP protection would lead to all kinds of dirty tricks, but what would be the profit in introducing a backdoor that could be leveraged to break crypto or an RNG?"

You get paid directly by the parties wanting it. That's what Crypto AG did for NSA a long time ago. They weren't making enough money so they risked whole business on a large sum of money to cripple machines sent to specific parties. The Snowden leaks quite clearly say this is going on domestically and with foreign companies although not clear on what (i.e. hardware) they're sabotaging to break the crypto:

https://theintercept.com/document/2014/10/10/national-initia...

For the locals, they paid between $30-80 million in one time fees to "SIGINT-enable" them per other leaks. Foreign nation-states, esp China, stay doing this sort of thing but usually with human assets working for the company to plant stuff. Now back to hardware. You're probably having a hard time imagining how it would look or even make sense commercially outside a shady deal with No Such Agency.

The first example was a wireless communications in non-online device. The embedded system just needed a cheap SOC. The engineers decided on an integrated one that was used in budget mobiles and data collection since they were already getting them dirt cheap for the phones. The RTOS was of course an insecure one common in embedded. Totally justified by the fact it was an offline device. The device could be hit with a software flaw that would enable remote access or location tracking via that silicon users had no knowledge of. In this case, though, they were just doing it to save development time & maybe quarters to dollars on each device.

Hardware guy said this stuff wasn't unusual due to three trends in ASIC development:

1. Need to add features to increase competitiveness.

2. Need to reduce number of new designs or components to keep costs down (esp mask costs).

3. Need to offer multiple tiers of capabilities and pricing on products ideally not paying for each individual one.

Hiding existing functionality they already bought or built in others is the natural solution to this. It's why 3G chips might be in CPU's or MCU's (eg Intel's ARC) might be in chips you didn't know had them. The hard disk companies are one of few that got caught doing it in that it's cheaper to mass-produce (for example) 1TB platters for all HD's of given model than many different platters. They just had a firmware or hardware setting in the chip to make it pretend to be lower space that they charged less for. AMD's triple-cores were another that was more open & reasonable where they were quad-cores with one defective core. They just turned it off then sold them as cheaper triple-cores. On mobile side, Shenzhen takes the cake with them cloning, modifying, and reselling anything you can think of. Their fake iPhone hit the Chinese market before the iPhone did officially at a fraction of the price. I'll let you wonder of security implications of high-ranking laypersons in business using an iPhone without any of its protection mechanisms built-in to CPU & OS. This doesn't even count all the counterfeit Chinese chips in U.S. products and military gear DOD reported on.

The weaknesses are already there. They're there for commercial rather than surveillance reasons. Many benefit the surveillance state with those parties bribing or coercing the companies to enable them for SIGINT. In some cases, like with RSA, they introduce backdoors directly for money that had no plausible explanation of benefit. Intel's chip-level backdoor, AMT, is sold as great for management & runs even when CPU is "off." Probably nothing to worry about. ;)

Hardware business is shady, dude. I can't tell you who is attacking, how much, and so on. Whole industry is full of NDA's from all the shit they pull. It's a black box outside the things above that leaked out.