“Unauthorized code” in Juniper firewalls decrypts encrypted VPN traffic

If it was indeed some entity like NSA, they can literally change code base without anyone noticing. What can anyone possibly do to prevent something like that?