It’s a lot easier to scan for very specific code behavior than it is to scan for “anything useful for espionage”. And that still wouldn’t solve the question of what their server software is doing or where the collected data is ending up.