I can think of several ways to exfiltrate data, even with the limited information you provided, so, yes.

But is it happening? Who knows. Maybe it doesn't now, but a future firmware update will. Who knows. Given your wise threat model, I'd avoid buying stuff from AliExpress.