You don't have to actively infect every HDD in the US through the front door.

- Target the build machine used by the dev team to make the firmware

- Target the manufacturing plant and alter it before loading

- etc