Fascinating. Do you have examples where someone thinks they're factory resetting an Android phone, but it turns out the device is still capable of a) running a corporate profile, and b) performing man-in-the-middle or any other attacks that "rooting" would allow? Or is this just a hypothetical?

Yes. It’s called xhelper and it can survive factory resets.

https://resources.infosecinstitute.com/topic/xhelper-malware...

Unless the factory image and firmware are completely immutable they can be infected. There have been other non phone malware that can survive on certain chips on computer motherboards which would exist independently of both RAM and hard disks. Even GPUs can be infected if they have memory that does not clear when the capacitors discharge.

https://arstechnica.com/information-technology/2020/11/intel...

It's ironic that such things are made possible by the degree to which computers are being locked down --- a "factory reset" isn't really, if all it does is reinstall from a "recovery" on the device itself.

xhelper certainly won't survive a full reimage, which is an actual "factory reset" and only available to those with fully unlocked phones such as some of the Mediatek-based ones. That's done by holding down a button while plugging into USB with the battery disconnected, which causes it to go into BootROM mode (and this is really a ROM). Then SPFlashTool can be used to erase and rewrite the entire internal eMMC.

http://networkingathome.blogspot.com/2017/04/restoring-mtk-b...