Gentle reminder that initrds are not authenticated at the moment. It's also possible that some software on the machine was insecure (installed on the side or not updated; I doubt they used otherwise unknown issues since they're expensive).

It's pretty likely the group of people in this has been infiltrated at some point, or simply that the places have been for a few minutes at least Evil maid attacks are fairly quick to conduct when the target is simply the initrd.