Back in the 1990s, their hardware design was simple enough that any mass surveillance would inevitably get exposed when the odd hacker took his device apart.

These days, I'm not sure at all. All we have is the law as a deterrent, and that's weak, especially to governments.