I mean, why not both? If I was a shadowy agency I would start an actual legit sewer inspection company that does real sewer inspections. And then just collect and share a little extra data as needed. Nobody would be the wiser!
Corporate ventilation. A wonderful thing. Everyone needs it. No one suspects it.
Or maybe it’s the aquarium guy.
No, those are the guys making meth.
Gotta love paranoia.
IIRC a hacked HVAC vendor was how credit card skimming software was infiltrated into Target and credit card data was exfiltrated a decade or so ago.
Edit, source: https://krebsonsecurity.com/2014/02/target-hackers-broke-in-...
Shhhhh!