I believe Qualcomm, snd others, usually cooperate and work with many vendors and grant access to their IP to many of these partners and overseas offices. And while they likely implement many tortuous security and auditing measures, invariably people outside Qualcomm will have access to their IP. And it’s necessary to get work done. And people pass audits and such, but work must happen and people granted acccess.

I bet there are nice holes for insiders (be they emps, partners, offshore, etc.), to get access and exfiltrate if they were so inclined.

Often it’s only legal repercussions which keep this from happening more often.