Somewhat on topic; I have a student who is analysing vendor malware, and in particular bad-things found on cheap USB memory sticks and solid state drives. She ordered a bucket-full of random junk from Alaibaba etc, deliberately letting it come through e-Bay type markets and unbonded warehouses. So far the results are as you'd expect, just horrifying.

This is why the ability to install auditable open source code is essential to the future of security on everything. Most of this stuff should be wiped down to the metal and re-flashed with something trustworthy before use.