I make Canary Radios. There are some configuration settings for using the different clients, but if you build and flash the firmware yourself there should be no backhaul…. Unfortunately, there are certainly techniques for putting back doors directly into the boot loader, but that would be done on extremely limited memory and its capability would be limited. To Jon Last name (optional)’s point high likely hood if it is sending out unexpected packets in your PCAP capture you are GTG…
On a separate, but related note, you should take a look at the Meshtastic docs and make sure that the network is configured for your use case - should a node forward messages “come up on the net” from Nodes it does not recognise? What packet headers are sent in the clear and is that ok for your use case? Etc. DM me if you’d like to discuss further.