Google actually serves the OTA for most devices, meaning they can "see" and check for malware. The files are stored on and downloaded from their serves. Given t

Google actually serves the OTA for most devices, meaning they can "see" and check for malware. The files are stored on and downloaded from their serves. Given the "rigorous" testing the apply to devices before they get Google Play certification, I assume they could revoke the certification remotely if malware is detected in an OTA, or even reject the OTA binary.