If that threat actor is building the technology, then yeh any threat actor could.
The concern is the unknown unknowns inside the tech that might be controlled by said threat actors. So you can take all the precautions and add in resilience, but if it's all from the same threat actor then all that is moot.
So the resilience and precautions comes from buying from multiple sources. Even developing our own production for it so what's inside can be known and regulated securely
I'm amazed it's France before Germany.
But I'm also so happy that this is happening.
The greatest war in history and all the horrors behind it should never be forgotten/hidden/suppressed/rewritten.
Everyone commited atrocities in that war. Nobody is without stain.
Document it all, and make it all widely available