We notice. They’re not hiding. The (numerous) endpoints are all presents in the about:config page. The actual content, though, is not that obvious to get. If we assume the binaries are compromised (I don’t believe they are for now, for the record), an outsider would only see a TLS session. At best we could get the vague amount of data exfiltrated, not really the content. But that’s hypothetical. For now.