[127361]

Minimizing all software phoning home as much as possible, and then watching for suspicious network activity.

Also dumping the flash* contents out with JTAG. And even better than that, physically disabling the network interfaces completely and not ever connecting the device to the Internet at all.

* = also the eMMC controller internal firmware, this is where a sophisticated implant will likely reside

It's also very unlikely that the hardware would be compromised, the government doesn't want to waste a potentially high value exploit on ordinary people. If they do, they risk having their exploit captured and exposed, and thus wasting it.