It’s always possible, if there’s a security flaw either in a future firmware upgrade, with the client software, or simply with the user’s own opsec.