You can always inspect what you are running right now. Again, they literally own the software. They could augment it at runtime, or do whatever else they desire

You can always inspect what you are running right now. Again, they literally own the software. They could augment it at runtime, or do whatever else they desire. You have to trust them that they don't copy your data. How the transport protocol works is completely beside the point. Security researchers analyze software in order to third party attack vectors. They do not analyze first or second party attack vectors, because that would be silly. There's simply too many of them.