This is basically the same as hiring a new person and giving them normal network access to get their job done. Did they upload a file to Beijing? Who knows?
So why are we doing this, if it is not better?
You mean hiring North Koreans. Which US companies are doing. Already.
There are whole branches of data security, practices, and products dedicated to answering that question and managing that risk.
The similarities look obvious, but how are these situations different? Seems like an interesting question.