I am asking this because based on Snowden's relevations, bad actors "interdict" (intercept) shipments of routers, HDDs, SSDs, servers, etc., install malicious rootkits and spyware in the firmware and then send the infected hardware to their intended targets.
Yes it is possible, as long as the firmware on your device is updatable. That depends on the vendor, but most do have updatable firmware. If the bad actor had enough resources he could reverse engineer the update utility and firmware itself to insert anything they wanted there, as long as it was small enough to fit on the tiny flash memory in the SSD/HDD.
If you're interested in hardware hacks, there has been one that (supposedly) compromised the supply chain of Supermicro motherboards recently: here