Exactly. It's not like it would take compromising the vendor, or the service contract. The install can be a simple and quick swap. The infeasiblity mostly seem

Exactly. It's not like it would take compromising the vendor, or the service contract. The install can be a simple and quick swap. The infeasiblity mostly seems targeting and monitization. You have no clue who or what will plug in, so it's barely useful for directed attacks. And actually getting value (intel or money) when all you know to expect is "a smartphone will connect" is quite hard.