Laugh, but LEDs by their nature are semiconductor devices capable of very high speed modulation, and the complexity of what's being built into the LED packages is increasing.
Subversion of these low-level components to create a data exfiltration vector is a legitimate concern, even if it may not be the deciding factor in this case.