They just chuckle to themselves and think: “These idiots have forgotten about things like SS7 and mobile networks in general… or triangulation… and that methods like UXDT still exist.” The safe way to handle any Android device is to assume it’s compromised from the start and not trust it at all—everything else is just a smokescreen. Why do you think cryptophones are being taken off the market, but pure software solutions are still allowed... What about the hardware... undocumented instruction sets, etc., etc. You can’t trust either the software or the hardware... Oh yeah, the devs say everything’s fine... but users completely forget about possibilities like NDAs...