Sure, but that requires the manufacturer to be intending to spy, in contrast to someone compromising after the fact.