The idea that devices are captured in shipment and modified is something that we know is done. Not only was this talked about in the Snowden leaks, but Israel itself has carried out similar operations where phones in apartments or hotel rooms were replaced with modified devices that exploded when called. A number of assassination attempts were carried out like this in the 1990s.
There are a number of incredibly disturbing implications to this attack that take some of the issues exposed in previous attacks and turn them into potential crisis points.
Firstly, this attack creates a space that allows for this to happen again. Once a nation deploys a tactic, and there is no forceful response, then that tactic has a nasty habit of being used again and again, across greater parts of the world, with greater frequency. The idea that this sort of attack would become common is horrifying.
Secondly, supply chains are almost impossibly complex. In the tech industry this has been a topic of discussion for some time. With capitalist globalization lengthening supply chains, and increasingly building supply chains based on just in time production, it is no longer clear who makes any given component or device. For actual supply chain security to be a thing we would need to know, from beginning to end, how each and every component of importance, as well as a device overall, is manufactured. Given the complexity of that process, this is functionally impossible for anyone to do.
Finally, as a result, we need to be more intentional with our use of technology. Abandoning communications tech is not a viable strategy, either politically or for everyday life, so it is not as easy as burning your devices. We also can't simply give up and continue going on as we do, buyig devices without thinking about where and how they are manufactured.