I see where you are coming from, and I agree that amazon shits on privacy. But this is another level compared to “only” spying on your users. From the article:

After devices appeared online, a stub application called x.cpe or com.oemservice would phone home. This package did not have any malicious capabilities of its own, but it had the system-level permissions necessary to install malware modules at the operator’s behest. It also disabled Play Protect, which would have otherwise flagged the silently installed packages as malicious.