&gt; It is your assumption that the perceived threat is a &#x27;nation-state&#x27;...<p>... That was the opening sentence of my paragraph that demonstrated that there is no such thing as &quot;guaranteed security&quot;. If you think that there is such a thing, then you&#x27;re going to be confused about many things when you think about security matters.<p>To the rest of your comment:<p>You need to keep things in perspective. [0]<p>* On Windows, Mac, and Linux malware can read and write to <i>anything</i> that the user who installed it has access to. It can read what other programs have stuffed in to RAM... including your password manager&#x27;s temporarily decrypted passwords. It can often record and exfiltrate the contents of one&#x27;s screen and the output of one&#x27;s microphone. It can often install keyloggers that capture banking, email, and other credentials. It can often encrypt personal data, lock the computer, send the computer user a friendly ransom note, and then decrypt that data once payment is received. Unless the malware is ransomware, it can do all this without <i>ever</i> notifying the computer user.<p>* On Android and iOS, malware can do <i>exactly</i> what the pre-installation permissions list says it can. Malware <i>cannot</i> read or write to data for which it does not have permission to read or modify. For instance, malware cannot be a keylogger unless it requests the <i>replace system keyboard</i> equivalent permission. For Android malware to read what other programs have stuffed into RAM, it -effectively- has to be authored and signed by Google and baked into the system image.<p>* Are you old enough to remember popup web advertising? Because (other than the platform) that&#x27;s <i>exactly</i> what the section you quoted from that article is talking about. In the PC world, popups are called &quot;annoying&quot; rather than &quot;malware&quot;.<p>Is the permissions system good? No. However, it&#x27;s <i>dramatically</i> better than what you get in the PC world.<p>Remember that Signal is software that is intended for rather secure communications. Signal&#x27;s threat model [1] <i>requires</i> that other programs running on the system be unable to tamper with the data that Signal puts into RAM and on to disk. You <i>can</i> get those properties with a PC, but <i>so</i> many non-technical users&#x27; PCs have been hit with <i>real</i> malware <i>ages</i> ago that that&#x27;s kind of a lost cause. Actual &quot;take over your computer&quot; malware <i>doesn&#x27;t exist</i> in either the Play Store or the App Store. This is <i>really good</i> for the average computer [2] user.<p>&gt; Maybe this is because I am also taking into account Android&#x27;s severe updates problem...<p>Wot? Other than the ~3 year update window problem, this hasn&#x27;t been a wide-spread problem [3] since Google put critical system stuff in the Google Play Services package (rather than baked into the system image) ages ago.<p>&gt; I&#x27;ve read and understood the same things you have...<p>Read? Maybe. Understood? Clearly not. I hope that you&#x27;ll take the presence of strong differing opinions backed up by sound reasoning and hard facts as a signal that some of your fundamental assumptions about the topic are incorrect.<p>[0] Indeed, maintaining perspective is a significant part of talking about security issues.<p>[1] Learn what that means if you don&#x27;t already know.<p>[2] Mobile or otherwise.<p>[3] Yes, you can point to abandoned phones. I can point to people with missing limbs, but that neither means that the majority of people are missing limbs nor does it mean that there&#x27;s a severe missing limb problem in the human population. :)