I am 99% percent sure the hackers are among the CUSTOMERS of Solar Winds.

That way they were able to live-test infected SolarWinds distro in their own controlled environment and develop all possible mitigations and techniques - the sheer amount of these evading techniques suggests they were built up over time, and not instantly.

Being Solar Winds customer and receiving infected updated versions every time gave them opportunity to perfect their techniques and hide for so long

At least that what I would do if I were a hacker and wanted to persist and be very careful about not getting detected