While it's a bit tinfoil hat, it's not impossible that there could be hardware backdoors in processors or other hardware triggered by a very specific sequences of packets.
There's still the question of packet sniffing by an intermediate device. The attacker would need to control (the network interfaces of) every device in the chain, use the ability very rarely to avoid detection, or hide data in packet metadata that is later decoded by interception equipment. This third option is probably fairly straightforward on any NIC with TCP checksum offloading.