Certainly a large dose of cynicism is needed to even entertain the possibility. My own cynicism stems from the Snowden disclosures and other leaks. I think the

Certainly a large dose of cynicism is needed to even entertain the possibility. My own cynicism stems from the Snowden disclosures and other leaks. I think there are more possibilities than you're considering. As far as I know, once a backdoored app is signed with the correct key, there's nothing stopping the partner CDN(s) from serving it to targeted users. In the simplest case, that's about 5 lines of nginx config. Also, the ability to stratify OS updates already exists because there are many combinations of country + carrier + device model + user permissions (e.g. special rules allowing internal/external developers and carrier employees to install development builds).