Someone else said elsewhere*

>Surely they are going to be loading it using Carrier Configuration tied to the sim card... As soon as you put a verizon sim card into your unlocked non verizon phone it installed a bunch of helper apps.

>https://source.android.com/devices/tech/config/carrier.html

[1] https://news.ycombinator.com/item?id=14004304

Not sure, but I do know for sure that the firmware to the radio is a proprietary blob that we, as users, have 'no rights' to. Meaning, they could already be doing this without notifying anyone, and we have no way to confirm beyond packet capture and analysis or reverse engineering. I find it hard to believe there is no market for an open-firmware phone.