They could be, yes. Once the code base is there then it is just a feature toggle at that point. One dial home to the mothership means one could be toggled on, toggled off as desired. As for shadowy I think we've seen they need not hide in the shadows nor do they even try.

Several computers that ship from Amazon have malware pre-installed. I found a case where it was installed but not running. To nobody's surprise I format any disk I receive before I actually put it to real use but many people do not. Malware being preinstalled and Defender being pre-configured to not alert means the malware can simply be activated by a dropper for any C&C agents doubling as an application updater. "We pinky promise it's just to update the RGB LED's".

This code should be installed like any other optional code. Ask the person if they want it installed and if they click yes then install it in the background and let them know when it is ready to use.