They absolutely are enabled by default, running as active daemons which cannot be disabled by the device owner. The circumstances by which they may be accessed

They absolutely are enabled by default, running as active daemons which cannot be disabled by the device owner. The circumstances by which they may be accessed include user agreement to "trust another computer", but may not be limited to that. Because DROPOUTJEEP.