The article alleges (b), and give indications of why it wouldn't necessarily be picked up:

> In one case, the malicious chips were thin enough that they’d been embedded between the layers of fiberglass onto which the other components were attached, according to one person who saw pictures of the chips. That generation of chips was smaller than a sharpened pencil tip, the person says. (Amazon denies that AWS knew of servers found in China containing malicious chips.)

There's plenty of precedent for missing things hidden away in stuff: https://en.wikipedia.org/wiki/The_Thing_(listening_device)