They have access through software companies who actually provide security. Almost all western companies depend on security solutions (ex: endpoint & SOC providers, that means every electronic device including IoTs has some tracking enabled) provided by Israel founded companies. And we all know Israel seems to be not following rules, even though these security companies have some restrictions on access to customers data, there is no one stopping them from accessing these data in the name of support. Many security companies depend on Israel based employees. And often these employees are drop outs from high rank military intelligence or some family member in a high rank military positions. So if a supply chain has US companies, they have access to the companies data. I am definitely guessing a lot. But the kind of intel they have makes me think they are illegally accessing these data somehow.

If this is true, think twice before using second hand devices. You might be mistaken for someone and unnecessarily targeted.

Note that you can’t basically avoid these companies. They codified using one of these companies in some US regulations. There are no alternatives between. Even though the companies themselves mention they are US based, most of critical technical stuff happens directly from Israel. There are basically no alternatives. They make rules, US follows.