I am security paranoid, so I am more inclined to believe it is true. I think the new article clarified a few things:
1. They stood by their claim that there are chips embedded in the motherboard PCB targeted at certain organisations. This is
not as hard to pull off as people think. Just look at any micro SD card. That's a large capacity multi-layer NAND and a controller packaged in plastic of less than 1mm in thickness. All PCBs I've seen in my life are thicker than that.
And you don't really need that much chip area to introduce a backdoor into what sounded like the BMC in the original article. All you need is some kind of device on the SPI bus to return a slightly modified BMC ROM after the image signature has been verified (if implemented). This will only require local modification of the PCB (SPI only uses 4 wires and does not have to be impedance/latency matched, etc).
With the spying budget of the second-largest economy in the world and considering the potential reward, I think any sane person in the spying community who have thought of this idea would be
crazy to not put it into practice.
2. There are a lot more examples of software exploits, which is perhaps old news to the security community. People have been asking for open source BIOS for years. The problem is the entire X86 ecosystem, including Intel's Secure Boot implementation, implicitly trusts (certain regions of) the BIOS even though BIOS modding and viruses has been around since the 90s.
I guess what's new is this is an insider job, so it wouldn't matter if you flash the BIOS again after receiving the hardware as the code that jumps to the backdoor is in the official release as well.
3. The Bloomberg article and articles linking to that (like
this one from well-respected security researcher Bruce Schneier) are now censored in China. Bruce also confirmed he heard similar tales from DoD.