All of the wires and cables, most of which is totally out of your physical control, could be tapped. Read-only CAT-5 cables can easily be made, and work even for the most inept. I'm certain that the local loop, the circuit connecting your domicile to the phone company's Central Office, can be tapped at many, many locations. The technology to decode DMT (the most common Layer 2 DSL protocol) is unknown to me.
DSL usually uses PPOE to communicate over the local loop. That means that the phone company's end of the PPP connection would be a logical, easy place to tap all of the IP-level communication. This is totally out of your control, and even if your TCP or UDP level comm is encrypted, you'd be subject to traffic analysis.
Hardware backdoors will be almost impossible to detect. Some Cambridge University people just published a good paper on a real hardware backdoor.
One way of snooping that you haven't considered is van Eck phreaking. One countermeasure to this sort of thing is to use weird fonts that are human-readable, but not TEMPEST or van Eck readable.
Another form of monitoring that you may not have considered is Traffic Analysis. For what's possible, take a look at Traffic Mining in IP Tunnels. The abstract is in French, but the PDF appears to be in English.