I obviously have no technical info, but my guess from this article is that 'back entrance' is probably inferring too much. I would bet that communication apps

I obviously have no technical info, but my guess from this article is that 'back entrance' is probably inferring too much. I would bet that communication apps A and B made connections to the same someCIADomain/IP range (or other less obvious metadata patterns, maybe the shared methods produced enough entropy on the whole to fingerprint). Thus even if one can't read the content of the message the firewall matches the discovered pattern === likely a spy; so if the less vetted App A source was compromised offline and thus the shared online pattern is now known so too are sources using App B who were less likely to be compromised offline.