We have no proof, but as such we have to assume that it's an NSA-directed compromise and take appropriate precautions, unless and until we have proof otherwise. That's why the NSA's actions really hurt.
This isn't a criminal proceeding . . . "preponderance of evidence" might be a more appropriate criterion. People are weighing whether they believe NSA malice or coder error are more likely in this situation.
