How do these things work with devices inside a NAT gateway? Most of our devices are inside a LAN. Even if a server gets started, it won't be visible to the outside world, unless we play with the modem settings.

Now, a hacker/state who has penetrated a device can do an upload of data from the local decice to a CNC server.

But that seems risky as you need to do it again and again. Or do they just get into your device once and upload everything to CNC?