Is this a substantiated claim in any way?

There's telemetry from Boox's app store, which can be disabled. I can sniff traffic and blog the results, if people are interested.

Edited: I should also note that my threat model is someone who cares about my personal privacy, but my life doesn't depend on it.

Someone else would need to inspect for the kind of rootkits nation-state actors would be worried about. I just use mine to read library books, doodle, and mark up white papers.