I don't think there's a huge amount of disagreement that such attacks are possible and are carried out. The skepticism is that the specific claims of Supermicro's servers being hacked by adding another chip to the board and that Apple and Amazon were affected lack credibility (and in fact Bloomberg has many sources for the parts of the article relating to the idea that China carries supply-chain attacks on IT hardware but only one source on the chip story and plenty of very specific denials).