I wonder the lengths smartphone vendors are going to prevent this kind of attack. I cannot imagine it is easy to completely validate hardware in such an elaborate supply chain. I shudder to think about the attack surface in something like a modern car.

The attack is profitable because it's targeted. Every one of those devices contains crypto. Which is not the case for mobile phones.

It seems unlikely that smartphones would be targeted for such an attack because almost nobody stores large amounts of crypto on their smartphone. Those that do will likely get hacked more traditionally.