I'm pretty sure in the case of at least Qualcomm, the carrier can do a heckuva lot more. Most snapdragon SoCs support a pretty hefty subset of OMA-DM at the bas

I'm pretty sure in the case of at least Qualcomm, the carrier can do a heckuva lot more. Most snapdragon SoCs support a pretty hefty subset of OMA-DM at the baseband level, allowing for execution of arbitrary 'apps' on the baseband, by the carrier. Throw in any vulnerability in that baseband stack, and now attackers have a very direct path to system memory.