You have it the other way around, security starts with privacy at its absolute minimum. If data is sent to a third party every time you tap something on the phone, you are using an insecure phone, regardless of what complex hardware they are using.
> But using a custom ROM doesn't necessarily mean you have to permanently unlock your bootloader, so that argument doesn't make sense.
True, depends on the phone though, some of them cannot be locked again and there's no way to completely fix those phones with a better ROM.
> True, depends on the phone though, some of them cannot be locked again and there's no way to completely fix those phones with a better ROM.
Then you shouldn‘t use those phones for a secure setup. I think we can agree on that. But the author of the article used a phone that is capable of locking the bootloader with alternate ROMs.
Security requires privacy. A phone without privacy is insecure by design, insecure because it leaks data.
And the biggest danger to consumers nowadays isn't a bootrom exploit but that their location, card payments and data profile is sent to advertisers.
If you assume this to be correct, then there's no point in attempting to make your phone private. Privacy isn't possible without security.
> None of that matters if your data is just sent to Google anyways.
when you use a custom ROM, that's not necessarily true. But using a custom ROM doesn't necessarily mean you have to permanently unlock your bootloader, so that argument doesn't make sense.