More specifically, the backdoor had been backdoored, as someone replaced the Juniper constants (which itself replaced the NIST constants) in dual_ec with their own, which allowed passive traffic snooping. The backdoor to the backdoor was backdoored.

I know but the DualEC one is kinda well meh. Only a single agent can most likely exploit it, it still requires quite a bit of computing power to decrypt even with selected values and you need to be able to capture VPN traffic.

The SSH backdoor means that any idiot with basic computer operation skills can log onto a firewall and start playing around with what ever they want.