Yes, they could do that, and in order to detect it security professionals would need access to their servers and/or reverse engineer their binary software distr

Yes, they could do that, and in order to detect it security professionals would need access to their servers and/or reverse engineer their binary software distributions where this is applicable. Whether they do it, I don't know, but I'd like to point out that Google used RC4 for SSL for a suspiciously long time after it was considered broken (all in the name of compatibility, of course). A change in public policy only occurred after the Snowden revelations. However, to make this clear, this is all speculation, they could do it but whether they do it I can't tell and no one else can without insider knowledge.