[sohei]

The factual basis of your assertion is absolutely true, but your attitude is unhelpful and defeatist.

There is a chasm between "a state actor throws an 0day at you" and "Google remotely installs an app on your phone". The latter is done at scale. The former is expensive, risky, and used relatively rarely.

If you're organizing a protest movement, it's totally reasonable to factor government 0days into your threat model. For more boring people, running GrapheneOS is a great way to reduce the attack surface they expose to the advertising and mass surveillance industrial complex.

[okdjnfweonfe]

its not exactly a 0day if the ISP is communicating (through an intermediary) to a card the ISP gave you, that's just normal, unexpensive

And this is like, literally a state actor installing an app in this case?

[fragileone]

In this case it requires the presence of Google Play Services. I'm unsure if there's any evidence that they can install apps without it being present.