Google has root on your Android phone, they can technically do anything they want. The only practical thing stopping them is their own scruples, for whatever that may be worth, or bad press.
Same is true for Apple.
(With one marrow exclusion for those who installed a "de-googled" Android variant and run no Google services.)
They can still do a lot. I'd much rather use software I can inspect to talk to the services I really need (firebase push) and replace the ones I can (like location). MicroG is great for that <3
It can even fake some of the more basic safetynet attestation crap and during Covid they made their own version of the Bluetooth thing. Marvin the dev is a great guy.
I don't know why people hate on MicroG so much. Grapheneos devs foam at the mouth when you mention it and in the lineageos irc channel you get Insta kicked when you mention it.
I really like grapheneOS features and it clearly increased my battery life but... . After looking at the community, some of the developers, seem fragile and unstable. It is the only negative I have for grapheneOS but it stands out enough to make me reconsider using it.
Malware tends to come from third party stores. An anti-malware system that only looked at apps installed from Play would be considerably less useful. False positives that trigger automatic quarantine are very bad. That's the root thing here.
Same is true for Apple.
(With one marrow exclusion for those who installed a "de-googled" Android variant and run no Google services.)