it is very real indeed. I've heard tale of this kind of thing being used in the wild one time, and there must be use of this kind of exploit in the wild that has not been detected.

read the paper, it will scare you at least a little if you understand what it lays out.

we really do rely on the hope that our compilers are pure, and we have very few tools to detect a bad compiler if our tools are also compiled with a malicious compiler. even if we compile the compiler from source, we can't know, because the compiler itself could be "in on it."