And even if none of that were the case, couldn't they just push out an update to the app or OS (just to the target, so other researchers debugging or watching t

And even if none of that were the case, couldn't they just push out an update to the app or OS (just to the target, so other researchers debugging or watching traffic wouldn't know) which would cause the device to exfiltrate the cleartext anyway? Or always have had said feature?