There's your problem right there.
The SolarWinds Malware was inserted in April.
No-one identified it for seven months.
Anyone that has been compromised could have been used in a similar attack.
Cisco is obviously the biggest threat of the lot.
Having said that, it is a titanic failure on SolarWinds part to let someone modify their updates and them not actually notice.