If you have a state level adversary with easy access to zero days then all bets are off. There is no way to attain true security without formally verifying the

If you have a state level adversary with easy access to zero days then all bets are off. There is no way to attain true security without formally verifying the entire software and hardware stack from the lowest level networking baseband to the userland applications. The alternative is to have a specialised airgapped hardware health tracker that is inaccessible without physical interaction.