As far as I know, all cell modems are binary black boxes, as are all SOCs, so their operations are untrusted in any absolute sense. Indeed, this is how Graphene OS describes their posturing and coding practices, as untrusting in the hardware, and their reasoning for only supporting devices with a Trusted Protection Module similar to UEFI Secure Boot on personal computers.

I have no mechanism to absolutely monitor the connections from the cellular modem, because they have a lower ring access to the hardware than I do. Everything could easily pass through a forked pipe and I would never know about it or have any way to detect this.

The reason mobile devices are shipped with orphaned kernels are many, such as theft of ownership through planned obsolescence. However another key factor is subcontracted software development where there is no ongoing development or support. The development is not some ongoing thing. They only patch the orphan kernel in cases where they are forced to do so. All custom ROMs except those that are based on a TPM chip are using CVE exploits on these ancient orphaned kernels to gain root access to the device. The entire business model is a skyscraper built on a foundation of swiss cheese. Cellular carriers have proven that they take security about as serious as a crack whore views abstinence, and still, I feel like I should apologize to crack whores everywhere for that comparison.

So if the hardware is neglected and designed for profiteering (legal piracy), the connection itself is untrusted, and the connection maker is an absolute shit show of bad actors and clowns, I simply try and avoid all connections through them most of the time. At least in this case, if they are running a forked pipe or other nonsense, they are clearly doing so illegally as I have used every tool available to me in an effort to maintain my autonomy and rights to citizenship in a democracy when that right is being stolen by this neo digital feudalism and digital slavery used for exploitation and manipulation of the third pillar of democracy Judicial/Legislative/Informative Press aka freedom of information. With only two relevant web crawlers that all search engines query directly or indirectly, there is no freedom of information. These results are not deterministic and there us no transparency about how they bias or bowdlerise results. Data mining stalkerware is at the scale of individual manipulative potential as is the potential of compute.

I'd love to feel confident that this all adds up to some remote and unlikely chance of no merit, but I simply can't see an intuitive reason why stalkerware is so damn profitable or even viable when everyone I know never clicks on ads of any kind, and yet we seem to be a primary target of such systems. The ads and targeting do not align entirely to the bottom 5% of stupid people like I would expect if they were driving the cycle by themselves. The stalkerware practices do not seem to align with commercial interests alone like what I expect from open market capitalism, thus implying some other mechanism at play. While it's speculative and broadly correlative, something seems fishy in this mixed bag of garbage, so I chose to keep the bag at arm's length out of caution. I don't fault others for their priorities or think anyone should adopt my perspective or values. I just don't see how a private DNS alters the landscape when it comes to cellular data connections run by dystopian clowns. However, I have a whitelist firewall on a third party device and rarely leave home. It is easy for me to maintain that connection.