This is where the Android security model really falls apart: The assumption that the ROM publisher/device manufacturer is trustworthy (or even just not pathologically hostile) is often false and the immutable OS means even technical users struggle to remove malware.

IMO: this sort of stuff means the pinephone actually has a better UX than the cheaper android phones despite calls and SMS often not working because the basic "computer with cellular data" works exactly the way you would expect.