well they kinda can... if they do any update to include software, that software can be anything... update systemd to include remote execution, or to install any

well they kinda can... if they do any update to include software, that software can be anything... update systemd to include remote execution, or to install any package they want (but why would it be a package??)