Wouldn't that be really obvious and spotted in any rudimentary testing?

I imagine it would be very non trivial to do it in a way that that was reliable and obfuscated enough to prevent detection for any amount of time?