What bothers me a bit more is, the OS could address a lot of what Graphene is talking about: there should be a builtin OS level “no overlays, no accessibility, allowed when superuser reqested, must use builtin OS controlled keyboard to input password”. I’m not saying the graphene team needs to do more work; their contributions are incredible. But they shouldn’t claim that having full control over a device you own is inherently a security flaw. Its a technical problem that can be resolved with ROM development.