I've always been suspicious that there's extra, "latent" first-party instrumentation code in consumer OSes that, when activated, does some additional "innocuous

I've always been suspicious that there's extra, "latent" first-party instrumentation code in consumer OSes that, when activated, does some additional "innocuous-seeming" metrics-collection, along existing metrics-collection channels, but that is actually just barely enough to be identifiable (in a way that's only apparent if you're a security researcher and you think really hard about it); where this switch is either activated per-device during system updates or virus hot-scan pushes, or per user for cloud-connected user accounts by monitoring a policy flag on your cloud account; and where these mechanisms in turn are activated by state actors telling the OS manufacturer to do so, to then collect the resulting metrics and de-anonymize the device owner. I mean, it's what I'd do if I were Apple and/or Microsoft, and I knew that the US government was constantly compelling my employees through National Security Letters to do a bunch of extra off-the-books work to enable transparent one-off device-specific wiretaps. I'd productize that wiretap process, to get my employees' time back.