I mean at this point they could also change the code running on the user devices, probably someone would notice but that's another story.

The point is: even if they could, should they do so when compelled by authority?