My guess is that with insider knowledge and a good firewall, a no-updates policy you can prevent phoning into the backdoor for a while.