The backdoors for mobile hardware is at the hardware level. I get the feeling that Google couldn't care less what you actually run inside of the VM that it android, what matters is how it manages access to resources like bandwidth and the associated meta/data required.

I'm sure there is some kind of way to profile what the VM is doing and send it out remotely, but the real security concern is using the phone itself as a platform. People already have secure computing systems, what they don't have is secure (or insecure depending on perspective) network access.