Yea, unfortunately all of every system requires some level of trust and I’m giving a big boy like Google a lot of trust their hardware is secure. But let’s say Google is clean, their schematics and chipsets are all vetted and stuff. There’s an additional layer at the fabrication of the hardware. Do you trust the Chinese hardware makers? If not then basically all devices are compromised. Need to trust the driver vendors, need to trust your ISP, need to trust your Os vendor, so on ad infinitum.

I’m also trusting the Graphene OS devs that they’ve done their due dilligence and ensure their hardened product is up to their marketing specs. I don’t think I possess any such knowledge to know 99% of this. I could take wireshark and profile its baseline data and make some assumptions, but what if all telemetry is just stored somewhere local and like on the leap year, the code fires it all off to homebase? I’m not likely scanning and analyzing 100% of the time so like it takes trust.