I believe they were referring to Cloudflare, not the hardware.
But yes, if nation states are part of your threat model, the safest practical way to acquire hardware is probably brick-and-mortar retail, and only after installing a sophisticated home security system, also acquired at retail, and thoroughly sweeping your house for existing bugs once it's installed.
But yes, if nation states are part of your threat model, the safest practical way to acquire hardware is probably brick-and-mortar retail, and only after installing a sophisticated home security system, also acquired at retail, and thoroughly sweeping your house for existing bugs once it's installed.