Comment by serial_dev

As you figured out, there would be many options to hide the "secret" calls. There is also no need to send these secret calls from all devices, it could be used only by a set of devices that are owned by "interesting" people. Assuming that is true, if a security researcher looked into things no longer proves anything.