The "permanent" thing is really scary imo. Probably easily detectable too if it's something installed directly on the eMMC, but i can't imagine Xecuter not caring about this.
Still, it's really probable, as they didnt even advertise once their thing was safe for online, when they clearly did it...