This doesn't sound like the sort of thing some rogue developer secretly slips into the codebase.
see: John Deere
Somebody was told to take a closer look.
Otherwise it would be very weird to have 3rd party developers disassembling firmware code. I've never heard of that happening because a train didn't want to start.
I imagine someone in the company was someone who knew (or was a parent of someone who knew) someone in Warsaw Hackerspace, and introductions were made.