Who verified the application firewall so that you can know it isn't hiding things from you (failing to report on transmissions to a hidden whitelist, for example)?
To your original point, I think it's better to buy an unlocked phone from the start. Subsidized phones will always have more strings attached.