A company buys laptops for its employees and they get shipped from outside the US, and before they get delivered nice changes have been made.

Any specific individual that is high value will walk into a store and buy from stock.

Ok and buys the laptop with malware? How the customs knows that high value target will buy that specific laptop they swapped the ssd? And what they do exactly? Put malware to steal his data?

You are working inside freaking customs and know where it is being delivered. Read between the lines.