The seed used in the pre-hash of the SHA1 function for P256 parameter generation (c49d3608 86e70493 6a6678e1 139d26b7 819f7e90) seems to never have been verified. If a large chunk of randomly generated curves are "weak", they could have just iterated random numbers to find this value. The seed was not some simple, small low-entropy constant < 10 or something*.
https://credelius.com/credelius/?p=97
This post explains the standard selection process by which the curves were selected: https://dissect.crocs.fi.muni.cz/standards/nist and reference 7 links to this article saying Solinas (who was formerly at the NSA) suggested the NIST curves.
There are some additional dubious posts on Stack Overflow:
Should we trust the NIST-recommended ECC parameters?
How were the P-256 parameters chosen?
And Twitter:
https://twitter.com/sweis/status/1176542191994335234?lang=en
Matthew Green rebutts this argument, saying ECCs are fundamentally broken if the NSA was able to use seeds to break curve parameters, which mathematicians would have found. Also, NSA's push for ECC may come from quantum computers breaking ECCs earlier than RSA*:
https://blog.cryptographyengineering.com/2015/10/22/a-riddle-wrapped-in-curve/
*=added due to commenters