That's kind of what I was wondering, I figured this as well as a way to track that it is at least sending data at unusual times. Someone else in this thread explained that actually determining what that data is would be difficult yeah: https://lemmy.world/post/48510943/24408747

I don't know enough about system security or forensics to evaluate this, but it does make sense based on what I know.