No more ridiculous a theory would be that Russian hackers found a way to get many thousands of other hackers around the world to plug in BADUSB/trojan devices. And to also fund their own compromise. :)

(No offense to our Flipper-creating friends. I suspect many hackers can appreciate the interesting and humorous human dynamics that are sometimes at play.)