> It does not have to be a goverment. There are other cyber criminals.

Criminals with the resources to maintain such a complex operation for two years?

Hobbyist around the world maintain projects for years and decades

Yes, crypto-boys for example. If the reward is 1B USD in crypto stolen from wallets why not do spend a year adding a backdoor ?

Difficult but not impossible. Some of the malware and ransomeware stuff is also created by experts.