[simonw]

Burning a zero-day like that for targeted advertising seems extremely unlikely to me.

[daveguy]

I think you missed the point GP was making. I believe they meant the vector might come from that kind of SDK. Not that someone who had a zero day to allow surreptitiously recording phone screens would use it for that purpose.