the data center which runs software written and controlled by the US companies and likely has a 24/7 software related support team which is distributed across the world....

in a modern cloud dater center you don't need someone physically plugging a USB stick in a server, you just need a back door in a cloud software stack many times the size then any modern operating system which often even involves custom firmware for very low level components and where the attacker has the capabilities to convince your CPU vendor to help them...

... a backdoor that is a necessity anyway, because it is constantly used to upgrade the cluster software.