It has been discovered before. As an example, a few years back someone found out that some Android phones' cellular modems were passively collecting base tower information when the phone was turned off, and then uploading it to Google when the phone came back online. The software portion responsible for doing it was Google's. I don't have any links to the articles covering this, but it ended up being quite a big deal, especially in relation to privacy/integrity laws in the EU.