it's only an issue if someone gets access to my device, which is not a threat i am concerned about. it is much more important to not leave random traces of activities all over the internet and especially not in the hands of a single company. my device doesn't log GPS, but google does. if someone gets access to my device, they get what i decide to store on the device. i have some control over that. i don't have control over what google does with my data.

google collects data on everyone. getting data by breaking into everyones device is not possible. there are to many devices for that. so that method is only interesting if you want to target someone specific. if i am a target then my phone is just a small part of what will be targeted. given the extremely small likelyhood of someone wanting my phone specifically, it's just not worth it to even worry about that.

> it's only an issue if someone gets access to my device, which is not a threat i am concerned about.

I hope you have no apps or ever run any JavaScript, good fellow.

we were talking about the bootloader. how is a locked bootloader going to stop malicious javasrcipt? for that other measures are needed.