Some exception cases: the phone needs to run a Mobile device management agent that installs and launches an antivirus, or the mobile happens to connect to a corporate VPN that routes all traffic and then inspects it via some appliance.