Is that necessarily true for NSA et al.? I don't see why the target couldn't just send the data towards an arbitrary destination, and that data be collected by NSA via a passive tap. Commands could be sent using a QUANTUM-style technique (packet injection with spoofed origin)