I’ll preface this with agreeing that you’re probably correct.

That said, it wouldn’t surprise me at all if Meta built an intentional backdoor, and that someone else (or many someone else’s) found it and was utilizing it.