They would remove them regardless of known compromise, because they have no way to verify it in-house and it’s the simplest PR and legal strategy.