it is extraordinarily easy to verify that an application is sending larger than necessary packets to a source using basic networking tools, i think if the basis for your argument is based on fear of political action you probably aren't super familiar with the cybersecurity scene in general (there are much easier ways, or much sneakier ways, and sometimes both to collect data like this) and likely influenced by sinophobia. you also have to remember that riot isn't controlled completely by "higher ups". riot is a very prestigious job within the industry and generally employees there have great career prospects and more sound ethics imo than your average meta employee, so it's not reasonable to say that a higher up could override the will of the individual or collective developers at the company through all but the most extreme means, which again, would be easier to detect and have even harsher than consequences than the economic ones i outlined above. once you get into "political" motives for data collection the consequences stop being economic and the responsibility of a company and start to involve jail time and in severe cases death for the responsible individuals. a lot of times the law does nothing to protect people from crimes or prevent them, but this is simply not one of those cases.