It means the spyware information flow and Google's ability to remotely modify the device have not been disabled.

It could have RCE but not privilige escalation. But I don't buy it, because 5 years without kernel patches is at least 5 escalation exploits being written by the an llm in 5 minutes