How would you know if it is tunneling out the data, concealed as any other kind of traffic, and at some future point after recording?

I am pretty sure it would be undetectable if done right, given no access to the source code of the multiple Facebook components running on your device (some pre-installed by the manufacturer and unremoveable).