I'm not entirely convinced of who is telling the truth and who is misleading us, but it's not implausible that this would go undetected in most places. If it happened, then:

1. It was likely a targeted operation.

2. It was affecting a small number of servers.

3. It was undetectable unless you were looking for it and had the blueprints for the motherboard.