Difficult but not impossible. Some of the malware and ransomeware stuff is also created by experts.

Hobbyist around the world maintain projects for years and decades

Yes, crypto-boys for example. If the reward is 1B USD in crypto stolen from wallets why not do spend a year adding a backdoor ?