I don't provide dedicated security services to start ups, so maybe I am outside my lane. However, it is my baseless assertion that nation-states are not dedicating entire teams and months of social-engineering research to backdoor a startup for non-monetary motives. I also suspect startups do not own the entirety of their own distribution infrastructure in production from the wheels, through the ISP, to the local keyboard.