Totally not useless. It costs a lot more to pay a spyware firm then to have an employee send an email / ask a judge (like that's even necessary).

I feel quite confident of my messages privacy on my Pixel with GrapheneOS given most people I message are on iPhones which are second in security to Pixels running GrapheneOS. Not to mention my threat model doesn't include mercenary spyware, as most people's doesn't.

If you're talking about the sideloading restrictions those were intended to stop social engineering and scams, not from getting hacked via 0days.

>Likewise, using privacy messengers like Signal is also useless if they can just take control of your entire device anytime they want.

Source? play services is privileged but not that privileged.

From being hacked by others. Google was just trying to protect their property, which is the ability to spy on their users' every move. Google themselves really don't need to "hack" their users for that, they already have all the access and all the data they could ever want. And they also have the ability to brick their users' devices at a moment's notice the same as Apple does.

In fact, following the OP's link to https://citizenlab.ca/research/how-discover-tech-turned-targ..., "the company’s ads were shown on almost 200,000 unique websites and Android/iOS apps in dozens of countries" so it's not just apps but ordinary websites you visit in your android chrome browser.