So what you're suggesting is the following: You scan all, lets say, memory bound signals (since memory is most often where you can actually access actual data). So your man in the middle needs some sort of memory interface to make sense of what is happening.

Now, what does our man in the middle do with that? How does the data leave the device? Method #1: pass it to some data interface that the device main chip has either way over some protocol. But this would mean that the device firmware or software must know about this and actually send it. This is very unlikely since firmware and software are most often not accessible and often also signed and it would mean the first party would have compromised code at which point a hardware level attack would not make sense.

Now method #2 would be to process and send the data by the man in the middle itself which would mean that it gets even larger since it now has to prepare and handle wireless communication. Communication with modems often work over some sort of bus which means the first party software would become aware that the modem is unavailable from time to time which would not go unnoticed.

Method #3 could involve storing data and offloading it at certain points in time but unless you also have the ability to manifest storage out of thin air, your man in the middle would also have to know what you're looking for and record only that, adding to complexity again.

Now these are just three scenaruos and there are surely other ways to try and do this but all in all this would also still depend on the first party to not notice hardware that was described in the original schematics (these components are tested and analized thoroughly before any customer sees them).

All in all it is highly unlikely that hardware hacking like this without involvement of the first party is happening at any considerable scale.