[fgeiger]

Are you sure this is the case? All the carrier app loading implementations that I am aware of (this is a small number) explicitly whitelist some carriers or even some apps by certain carriers. For instance, the implementation I worked on myself (as a reviewer) only granted a single carrier to load one of their apps when the SIM card was inserted.

With that implementation, it would not be possible for any random carrier in a foreign country to load random bloat onto my phone just by me crossing the border to that country.