But they sure can serve it successfully. They control the cables through which everyone's internet traffic passes, and when you download a program (such as Xcode) they can substitute it with their poisoned program [1].

I'll quote:

> All it takes is a single request from a victim passing a wiretap for exploitation to occur. Once the QUANTUM wiretap identifies the victim, it simply packet injects a 302 redirect to a FOXACID server. Now the victim’s browser starts talking to the FOXACID server, which quickly takes over the victim’s computer.

... or doesn't take over the victim's computer, but provides a download of a poisoned Xcode.

These motherfuckers have compromised the whole internet.

[1]: http://www.wired.com/2013/11/this-is-how-the-internet-backbo...

True, but Snowden's data haul is at least a year and a half old by now, and some of the files cited in this article date back longer than that.

But I edited my comment to include your point: no hard proof that this technique was used...yet.