They can be used to start an exploit chain on a phone. I’ve seen 0-days personally that root a phone by triggering a drive by download. The other issue is they

They can be used to start an exploit chain on a phone. I’ve seen 0-days personally that root a phone by triggering a drive by download. The other issue is they are unauditable. You have to almost go to the link to discover what is there. This is a problem, for example, when shell code can own the camera itself.