>Can you permanently apply chain3 (FIREWALL_CHAIN_OEM_DENY_3) firewall rules, so that when the device reboots these are still applied?

Just use firewall VPN apps + VPN lockdown mode (ie. "block connections without VPN").

>So does a Phonograph from 1877, right?

I think it's fair to factor in what feature was lost because wireless-adb-on-localhost was removed. If some critical accessibility feature was lost, that would be far more important than something that's merely a mild annoyance, like needing a second device to run `adb install`.

>I just pointed out how evil and malicious that privilege escalation on my own device is. Google must block it immediately, it endangers the mankind.

Right, but going back to the docker root analogy, would you think it's unreasonable if people threw a hissy fit of linux kernel/docker developers added some security feature that blocked it?