Possibly so. It just means that based on the report's findings, even if you'd decided to play it safe and buy exclusively from NXP directly (the creators of this ecosystem and owners of the MIFARE trademark), it looks like you could still end up with backdoored hardware.

They found the exact same backdoor key present on old NXP and Infineon cards produced as early as 1996. See p.11:

> But, quite surprisingly, some other cards, aside from the Fudan ones, accept the same backdoor authentication commands using the same key as for the FM11RF08!

> ...

> - Infineon SLE66R35 possibly produced at least during a period 1996-20136 ;

> - NXP MF1ICS5003 produced at least between 1998 and 2000 ;

> - NXP MF1ICS5004 produced at least in 2001.

> ...

> Additionally, what are we to make of the fact that old NXP and Infineon cards share the very same backdoor key?

I think it's more likely those NXP/Infineon parts are counterfeits. Look at A.12, there are early cards that don't NACK $F000 but claim to be NXP or Infineon, behavior counter to legit parts. It looks like the Chinese copies started to chameleon that behavior later as well.

... or used the IP without licensing.