The only real way to compare if a firmware image has been modified is to be able to take the firmware from the device, take a hash of it, and compare it to the hash of a known good copy.
The image taken from the device must be obtained in such a way that any malware on the device can't tamper with the image being exported (i.e. obtain the image before the system boots). I'm not too familiar with iPhone forensic tools, so I couldn't tell you the cost to do something like this.
Do you have reason to believe you would be targeted by the CIA? The reason I ask is because the more often tools like NightSkies are deployed, the sooner they will be detected, and will lose their value. Intelligence agencies choose their targets carefully for this reason. What was most likely occurring was interdiction; essentially, grabbing the device out of the mail before it went to the user, installing the malware, and then putting it back in the mail. To summarize, if you or the organization you work for are not a target, you shouldn't worry about it too much.
