Presumably components of the hardware or software could be compromised somewhere upstream by nation-state actors like the CIA and NSA's TAO. It's not as if Iran's nuclear facilities were connected to the Internet and that didn't exactly keep their centrifuges safe.