But from the audio recording it seems like one pilot is noticing them bering in the CUTOFF position, and asking why (and moving it back). If the switch was actually in RUN, but some other issue caused the signal to be sendt, the pilot would see it beeing in the RUN position, not CUTTOF.

Are they looking at the physical switch or data about the state of the engine displayed in some other fashion?

This is very clearly EAFR data, so the logical/electrical switch state. Nothing about the mechanical state of the switches has been mentioned, except a picture that shows their final state to be in the RUN position (which makes sense given the relight procedure was ongoing).

From what I understand, the relight procedure involves cycling these back to CUTOFF and then to RUN anyway. So it is not clear if they were mechanically moved from RUN to CUTOFF preceding the loss of thrust, or cycled during relight.

Where can I listen to this recording?

You can't yet - what we have is this sentence from the report: "In the cockpit voice recording, one of the pilots is heard asking the other why did he cutoff. The other pilot responded that he did not do so."

It's not a direct quote or transcript, it's reported speech.

I agree, there's a significant distinction between "the switches were (physically) flipped" and "the circuit was opened/closed".

In this case, it may be a moot distinction, particularly if no physical evidence of fault or tampering has been discovered in investigation. But, in theory, very important - there's a lot of potential grey-area between the two statements.

The proximity of the incident to the ground may also increase the possible attack vectors for simple remote triggers.

My understanding from what we've been reading is that these are physical switches that cannot be moved using remote triggers. Wildly speculating, there _may_ be a possibility that the _effect_ of the switch may be triggered remotely, if it's a signal being read by a control unit or computer of some sort that then actuates the specific electromechanical components. But it would seem impossible to move a physical switch to do it.

As an analogy, if you have a smart lock, you can remotely trigger the _effect_ of turning the key using (let's say a bluetooth control), but if a key is inserted into the keyhole, unless there is two-way mechanical linkage, that key _will not turn_.

Any switch becomes irrelevant if a saboteur has access to the behind-the-panel wires that the switch operates.

But I presume that would leave physical evidence which would have been discovered by now. Presume, but cannot be certain.

If that was the case, it does seem a bit odd that there was a one second gap. But yeah, still worth investigating, if that’s even possible given the extensive damage.