They wouldn’t need to be that clever. With the default firmware these things are a black box. They might have something else that it remotely downloads that can simply run arbitrary code. We wouldn’t know it.