That's scary from a user perspective, but harder to monetise at scale as an attacker. Proxy endpoints are just another commodity (and offer recurring revenue).
replyIf you infect tens of vehicles that's not that valuable. But if you infect ten thousand vehicles, convinced a trusted member of one of the bigger black hat forums it's real and have him vouch for your marketplace post, there should be some buyers for full movement profiles, call logs and address books of ten thousand people
replyAnd doing that doesn't really interfere with also setting up and selling proxy endpoints
Yeah, especially since most of these are already available for purchase from data brokers.
replyThey're called data brokers because they have a buy side, too. That might be peanuts to you, but to an AliExpress seller, it could be most of their profit.
replySome head units (working with a 1st party one atm) have two networks: OEM-paid (unlimited data) and user-paid. A 3rd party apk would be consuming all bought traffic quite soon.
replyAlso typical Android permissions still apply. The user would need to grant the malicious app contacts, call logs, etc permissions.