I think it was baked into the OS somehow (probably what you said). He disabled system updates as well so the OS didn’t wipe. The only way it could have been removed was flashing the OS, but you’d have to find out it was there to begin with.