I think the GP meant that it's harder for _the vendor_ to do it, because there are assuredly many privacy-attuned nerds who would run wireshark a bunch on it and notice when the $ListeningPost becomes an always-on bug.

I don't think they meant to imply that it would be hard to to cause such behavior via malicious action by 3rd parties.