Carriers have enormous control over devices. While we now know it didn't happen, they likely could have easily shipped a manipulated standard phone app since when a carrier gives out a device it is often running customized firmware with the carrier's logo on boot and preinstalled bloat ware like Spotify, Facebook or WPS Office (by my experience with branded os images for Sony Xperias).