Your handwavy fix is almost completely unrelated to the research. These were large companies. They generally always buy phones through third parties. And when w

Your handwavy fix is almost completely unrelated to the research. These were large companies. They generally always buy phones through third parties. And when work gives you a phone how will you figure out who touched it? Rather than giving people a lengthy and arbitrary list of purchase caveats, why not ask why it's so difficult to secure an android phone through the supply chain? And what, if anything, are other phone manufacturers doing that might be making the problem much more secure?