Yes, they can. This is another reason for having closed source blobs running as root under Linux/Android to manage all communication.

You cannot fight for this, unless you design both the communication hardware and its firmware and you get away from Google Play.