One interesting point is that there are hard limits on ghostly comm channels. To avoid detection they have remain within plausible noise levels. This means that only a tiny fraction of total network information can be exfilterated without detection, which supports your point, that it is, mostly, not happening.