[rightbyte]

> If a bad actor wants to pwn you they'll do it on your device and you can't stop them. I think that's broadly true of some actors.

I mean that is correct in the literal sense. Both Google and probably Samsung can hack my device remotely by remote code execution via targeted updates. So American and South Korean authorities.

But I don't think any "bad actor" could do it?

Like, the Foobarland police. Is that a reasonable take?