Of course, they could have fooled the compliance department using the same techniques used to fool regulators in the U.S., i.e. the exact same capability they'd

Of course, they could have fooled the compliance department using the same techniques used to fool regulators in the U.S., i.e. the exact same capability they'd built into the software. And they could probably have managed to trick engineering into creating that capability in the software by labeling it with a different and seemingly legitimate reason for existing. So I think you could plausibly get it down to just upper management, but I agree that there is no way engineers knocked this off by themselves.