You don't need to run the server to backdoor the client. You just need access to push updates to the client. It doesn't matter who runs the server.