Comment by runjake
I can think of several ways to exfiltrate data, even with the limited information you provided, so, yes.
But is it happening? Who knows. Maybe it doesn't now, but a future firmware update will. Who knows. Given your wise threat model, I'd avoid buying stuff from AliExpress.
What makes you think "American" products aren't just rebranded AliExpress products essentially?