I see variations of that argument very often. Its essence goes like this:

A: This is a proven threat.

B: But so could be this and that.

A: Right, could be.

B: But we can't get rid of them all, so let's just do nothing.

Here person B somehow convinced themselves that doing anything in that regard to be futile because they can't solve this class of problems once and for all.

There is a distinction between possible threats on one side and an existing threat based on evidence on the other side.

Any device with the capabilities of a smartphone can be nefarious, but doesn't have to be. Any Android device certainly is.

So I'd like to tell people to turn off their Android devices, but may they keep using their open hardware and software phone, because I don't see them as the threat, but the entity that controls their Android device.