The problem is that third-party OEMs don’t have to run AOSP, they can easily replace any and all code with malicious call-home backdoors, and still pass CTS tes

The problem is that third-party OEMs don’t have to run AOSP, they can easily replace any and all code with malicious call-home backdoors, and still pass CTS tests. As far as I can tell, there is no meaningful protection in place to prevent OEMs from poisoning the Android well (and the Android brand), even without considering the black box firmware running on wifi/BT/LTE/5G modems.