You realize sneaking in code to arbitrarily exfiltrate user data is much simpler if a trusted source (in this case Recall), is doing the collecting