The question we should be asking is:
With seemingly admin access to the networks of so many other software (and other) companies. What other "digitally signed" malware will they have created in the last 9 months whilst they had access to do so?
Conceivably all kinds of software could have been tampered with, with the access obtained through solar winds Orion. No way of knowing without companies going line by line through all the software they've released in the last 6-9 months. Even the big boys, Microsoft, Google, Apple if they used the compromised version of Orion on their networks, any software they've release since March could also have been compromised.