Middleman involved in the shipping are probably the cause.
Many years ago, I worked at a now-decommissioned nuclear power generating station in S. California. I did software development in the Health Physics dept.
One day I noticed that every few minutes, the PC of the developer behind me (we had "bull pen" cubes with 4 per bull-pen) would annoyingly beep.
I asked him what that was, and he said "I don't know, it just does that. I ignore it.
Turns out it was a virus. It was brought in by the local PC vendor, who one day went around from PC to PC, updating the Video BIOS of PCs equipped with a particular Matrox display card.
My PC didn't have that card. The other fellow's PC did...
It was eventually discovered, when somebody else didn't just ignore it...
This was outside of containment, and so it spread further than it would inside of containment. Due to the "what goes in, doesn't come out" policy, had the vendor updated PCs inside of containment, he would have had to have left the infected floppy disk inside. The infection would have been limited to containment.
We can all sleep better.... egad, what am I saying?!