They can be forced to change their code, affecting their endpoints, and acting as a wiretap yes. But in the OP's view he said it was an Open Source protocol, which wouldn't get a lot of "forced/secret patches" because it's too easy to see.