I would like to remind people of the 2016 Adups backdoor:

According to Kryptowire, Adups engineers would have been able to collect data such as SMS messages, call logs, contact lists, geo-location data, IMSI and IMEI identifiers, and would have been able to forcibly install other apps or execute root commands on all devices.

https://www.bleepingcomputer.com/news/security/android-adups...