Devil's advocate: assuming the company already quietly install updates, and the backdoor is not secured worse than the auto-update mechanism, this does not really give them additional capabilities. (Also, the phone likely already has more serious vulnerabilities.)

Of course, this exchange does suggest bad things about the company's ethics and competence.