Re: Well if the US ships want the Chinese to keep out of the way
"For the FBI at least, there's a fair few articles suggesting that Cisco has at least acknowledged that the backdoors existed"
As Cisco's product range is so broad, there are many security issues that are either not relevant to most environments or shouldn't be relevant to many environments. A lot of the backdoor accounts are in management tools that should be of limited risk (i.e. not open to external threats) and were a consequence of how Cisco presented their Linux tools to customers, usually via a GUI with limited direct OS access. In my experience, a number of appliance vendors had similar issues when they tried to provide restricted access to the underlying OS but still allowed access via troubleshooting tools.
That isn't to say they shouldn't be fixed, but access to network management data from an internal network will generally be of less value than access to the network in the first place, so the risk should be assessed as such.
If the comment is aimed at Cisco's security culture, then that's a judgement call. My security concerns around Cisco are largely around the quantity of legacy code that they depend on (as evidenced by security bulletins related to OpenSSL) rather than government palnts.
In most security sensitive environments, multiple vendors will be used, be it for firewalls, IPS/IDS systems, compliance tools or anything with a potential external attack surface. Having back doors from any vendor (Cisco, Huawei or anyone else) is very likely to be spotted by someone over the time frames the products have been in-place.
Where government agencies have been able to infiltrate networks, the weaknesses have generally been in operational practices rather than the hardware platforms - I include not installing known good firmware on new hardware in that category which has been one of the most popular vectors.
Improving operational security practices will likely result in significantly greater security benefits than believing the bogeyman is hiding in vendor X. At least until someone proves otherwise.
Biting the hand that feeds IT
