and what endpoint would it use to upload those files? what's the authentication needed for those endpoints? why would everyone on earth fail to notice these exfiltration endpoints if they exist?

you're being unnecessarily hostile about a threat that almost certainly doesn't exist. And if it does, you can absolutely block those uploads before they even happen. In fact if you don't already block uploads to hosts you don't know about, then you're not really taking anything seriously, are you?