I worked at a large tech co with an assembly line in China and experienced this first hand. A routine scan of one of our calibration machines turned up a Trojan with a copy of all calibration software squirreled away. Fortunately nothing is network connected there, but it was obvious someone was planning to come back for it. The stash had our calibration software and the factory’s proprietary control software on it. Both companies sent security to watch the machine for 48 hours straight until a hard drive shredder could be procured to mutually assure each party no software would leak. It was nuts, but apparently common.