In the case of the stolen CIA drone, the hardware with the backdoor was most likely embedded within he telemetry system, which is the multi-function brain of the drone, in fact every system within the drone is routed through the telemetry system, every sensor, every control, everything.
In fact the telemetry system is how the Airman at Nellis AFB uses via the joystick to fly the drone like it was a video game.
I do not know about this particular telemetry system, but from my experience at White Sands Missile Range during the early 1980’s it was common to use FM/FM modulation techniques.
All the Iranians needed was to be able to emulate one of the multitudes of frequencies used for telemetry purposes to trigger the embedded hardware purchased from the Chinese and installed within a US secret drone.
Once that hardware is triggered it is programmed to change the all the other frequencies used to control the secret drone and allow the Iranians to take total and complete control.
Imagine the young Airman with joystick in hand, and his commander at Nellis trying to capture images of any collection of buildings, gas stations, or old tires in the desert.
