But did they find malicious chips elsewhere? And what is their definition of motherboard, chips and malicious?

All of these statements seem to be pretty well crafted. It is entirely possible that they found components that don't belong, but don't consider them malicious without the underlying payload that gets uploaded.