Comment by simpss

I think the real question is what mechanism allows them to push a random app to some phones? google play services is actively listening for remote installation requests?

that's essentially a remote-code-execution backdoor to all android phones?