They may have access to backdoors in the baseband firmwares.

The baseband is an opaque binary blob that operates outside of the phone's main OS, and its contents are usually considered a trade secret by the manufacturer since it handles low-level hardware interactions with the main radios/etc.

Personally, I would be surprised if those systems weren't compromised by agreement. It's already common to see criminals and dissidents get busted because they think that turning a phone off stops it from reporting location data.