Considering China is a communist dictatorship, the company is the state, in a way.

Now my biggest guess is that xhost + is being used to allow a process running as root to launch a window into the existing xserver no matter what (probably a graphical client).

It's a very bad practice though. How comes that devices can autorun software nowadays?

They can't, he probably installed whatever software that came with the hardware.

There is a few mechanisms through which hardware can get the OS to execute code, so it is possible for the BIOS to cause software to be installed. E.g. the easiest one is probably the "Windows Platform Binary Table" in ACPI.

I guess you're right. I don't understand why my previous comment is being downvoted though.

I mean, HN has an explicit rule about not claiming others on the site are part of state campaigns, so flagging seems like the correct response?