I thought android had its own bootloader and I assume drivers (At least Linux has its own drivers). To my understanding if android phones have a bios that’s the only thing that could be compromised but it should just provide the interrupts right? Now that I think about it if Google put a huge bios in there it might be able to access and share things it’s not supposed to. (But I feel like people would have noticed.)