This makes me think of an even more straightforward attack. How hard would it be to actually just ship them computer hardware and hope it makes it into the system?

I mean, if a package that looks like it came from NewEgg containing a router shows up, especially if it matches the type the company usually uses, which wouldn't be too hard to figure out, what are the chances it just gets tossed on a shelf to be used next time one is needed? Or do companies have sophisticated controls in place for something like that?