Believing the software can somehow be separated from the hardware is a lie. They can mitigate at best the the amount of information one can extract but at the end whoever control the hardware can have access to extremely private information.

A gyroscope sensor is able to accurately record what one say close to his phone. It doesn’t even need Android to run he has access to private information.

https://crypto.stanford.edu/gyrophone/files/gyromic.pdf