I think there's a difference in saying "software tends to be buggy, security can't be perfect" vs "I'm using a baseband modem running out-of-date Linux, that has DMA to my entire phone, that the manufacturer has stopped supporting, and there's active CVEs".

> Without physical possession of the device, access to drivers passes through the OS.

With all due respect, that is not a wise take on modern device security. At all, all, all.