“It is now clear that some hackers have figured out there is no quick and easy way for a company that receives one of these EDRs to know whether it is legitimate.”
An emergency data request skips the judge and the paperwork if a cop says someone might die. There are about 18,000 police jurisdictions in the US, and hackers only need one compromised email account. Teenagers in LAPSUS$ used this to pull customer records from tech companies. The backdoor built for police works just as well for anyone who can phish one.