One aspect not covered here: if such a device was around a person with classified status, at any hour of the day, shouldn’t we need to label it as a probable eavesdropper? I imagine a chunky yellow label saying that we technically cannot tell if this phone has spyware, because bossware activity is blended in.