It's been done.  I personally know of at least one major organization that cancelled a contract with a Chinese manufacturer of PCs for that very reason.

Embedding that stuff in the firmware makes it difficult to detect, since standard anti-virus programs don't look for it.