So imagine a scenario: 1. crime organization (or governmental org) buys / steals a bunch of phones 2. org opens boxes, tampers with boot loader in such a way

So imagine a scenario: 1. crime organization (or governmental org) buys / steals a bunch of phones 2. org opens boxes, tampers with boot loader in such a way that they (and / or the original OEM and / or the original OS vendor) have a persistent remote administration account on phone 3. org then returns phones to supply chain either covertly or off the back of a truck. 4. org leverages remote access to do shady things 5. "the press" finds out that "vendor phones XYZ are trojaned!" and vendor looks like t-mobile for 5-30 hours until people find another cat video to look at. A theoretical justification of this is that phones are stolen all the time from the supply chain. Making lots require remote activation allows the vendor to kill the stolen phones, reducing their resale market in that part of the stolen phone ecosystem. Another theoretical justification is to "protect" the average buyer who just wants a damned phone to look at cat videos on and maybe call their spouse when they're late; they don't wear boots and don't care about loaders. Just Want Cat Videos.