It's possible, in the same way that embedding telemetry in a jpeg image is possible. There may be bugs in the libraries reading the data that could possibly be

It's possible, in the same way that embedding telemetry in a jpeg image is possible. There may be bugs in the libraries reading the data that could possibly be exploited for allowing arbitrary code execution. Now, if they did so, it's likely to be found out at some point and nobody would trust them any more.