The baseband processor in a cellular phone has full DMA access to the system. So yes, backend initiated software install with no notification to the end user is

The baseband processor in a cellular phone has full DMA access to the system. So yes, backend initiated software install with no notification to the end user is absolutely a valid point to represent in a threat model. Rule of thumb for cellular phones: they are not your computer at the end pf the day. Between manufacturer collusion with Telcos, and legally mandated collusion between Telcos & Government, your phone exposes a small enclave of purported privacy that no one will attempt to look at (until they do); the rest of the system is essentially shared in management between user installed applications and stuff done in the background by the service provider.