>but my assumption is a factory reset should remove EVERYTHING that didn't come on the phone put of the box A simple proof that this isn't the case is the fact

>but my assumption is a factory reset should remove EVERYTHING that didn't come on the phone put of the box A simple proof that this isn't the case is the fact that factory resets do not revert your phone back to the same OS version as it came with out of the box and it does not download an OS image to install. The only device I know that does this is macbooks have a built in recovery which can be used to download a fresh OSX image and install that. On an unrooted/unexploited phone a factory reset should remove every bit of data bad app has access to. On a rooted phone you can wipe everything by downloading the vendor image (Google supplies these but not all OEMs do) and then you can flash that over the entire phone which replaces everything on the storage.