1. The NSA hacks BIOSes. Indeed it does everything that it wants you to worry that the Chinese might do and more. The NSA even monitors certain online orders of computers so it can intercept the computers and modify them with BIOS-level or system-level spyware.
2. It’s possible to hack a MicroSD card — or indeed any flash storage device. I’m waiting to learn when the NSA does that too.