No, they haven't
> "We have no indication of this," company President Brad Smith told New York Times reporter Nicole Perlroth.
That's not a categorical denial of being penetrated, it's a denial of having information about being penetrated.
> Apple has never found malicious chips, “hardware manipulations” or vulnerabilities purposely planted in any server. Apple never had any contact with the FBI or any other agency about such an incident. We are not aware of any investigation by the FBI, nor are our contacts in law enforcement.
Oh, I agree that no company will ever make a categorical denial of something like this; I just don't think that justifies promoting a lesser denial into a categorical one.
Even if the information was discovered during a government or private investigation of the hacks that didn't include Microsoft, the investigators likely would have notified Microsoft immediately.
Don't apply to matters of national security. Seeing as solar winds supplied every branch of government and just about every company that matters in the U.S., I would imagine that there are a lot of people under gag orders, or prohibited from talking about classified Intel with people that don't have clearance. To be safe, it'd be wise to not have company officers who also hold clearances.
The statement about supposed CISA opsec guidelines is equally confusing, can you please cite the specific guidance you're referring to which would keep executives in the dark? I'm pretty familiar with the guidance CISA has issued and I don't believe any such advice has ever been given.
Before an executive would talk to the media about a subject like this, they would absolutely have gotten details from their internal security team.
On the other hand, if you read the CISA alert[1], it's clear that (1) many industrial targets were compromised, given the ubiquity of the Orion product and the amount of time that transpired; and (2) the attackers had their merry f'ing way with MS products like AD. So at this point I think it would be more surprising if they were not compromised than if they were.
I don't think the statement was meant that way, but it just shows how defensive the wording is.