>planting a mass backdoor is probably not worth the risk of it being detected.

everyone is ignoring what was pointed out by "kennywinker"

https://news.ycombinator.com/item?id=20884384

the fact that both for android and for iphone seperately, there is a correlation with sound / silence and data usage, even if in the opposite sense. why did this not at least prompt the investigator to dig deeper?

I was in fact referring to exploits in my post. That's typically how NSA and GCHQ operate these days: either find exploits, or if a sufficient number can't be found, have some hard-to-detect exploits inserted into the code by operatives or as part of unrelated bug fixes.

There's also hardware exploits. The firmware doesn't need to have a back door if a certain sequence of packets sent to the network controller will cause key memory to be overwritten and live patch in a backdoor.

Agreed, hardware backdoors are very possible, but software is much cheaper to mess with. The spooks have in the past shown a preference for hardware jimmying, but those have been one-off cases.

That said: monkey-patching is much more easily concealed than hardware or source-code changes, and is more in line with how US spooks have been seen to operate.