Wow, really bad day for Supermicro and the server industry.
Do NOT buy the stock long or short, the longs will be catching a falling knife, the shorts will get squeezed hard if this is a hoax that Bloomberg fell for once the stock recovers. I wonder though if some people learned the news early and shorted the stock, maybe some chinese PLA officers? ;-)
Assuming the reporting is correct, my money is on an interception chip for the IPMI-SoC (Aspeed 2400/2500) <-> serial boot flash chip connection traces. The interception chip will do a search & replace on the data while the SoC is busy retrieving its firmware from the flash chip, also correcting any checksums to let the Aspeed continue booting. When up, rogue code will try to ping some outside machines via UDP or maybe a sneaky DNS tunnel, waiting for instructions.
One instruction could be the download of more code for execution on the SoC. From there, a stronger foothold can be established on the SoC and through lateral movement within the management network of the unsuspecting operator. Since the Aspeed can flash the BIOS, trojanized UEFI modules could be used to subvert any OS running on the hardware. Which is truly a nation-state endavour.
If you weren't sure why HPE introduced "silicon root of trust" in 2017 with iLO 5, now you can be. I think they heard the news early. Their SoC will only execute cryptographically signed code from its boot flash and the only way to subvert that would be either to break a presumably large public key (very unlikely), or subvert the iLO SoC silicon to accept any code. If the chip is diffused in USA, I would call it game over. Unless the "sufficiently bored party" goes ahead and clones the entire iLO chip with fake crypto verification and has that put onto server boards instead.
I am not sure what the fallout will be. Maybe higher prices for servers because manufacturing will move out of China, with chip diffusion happening for security reasons in Europe or USA pretty much out of chinese reach, and assembly of stuff happening in Mexico to take advantage of low wages.
Just my 2 euro cents.