GrapheneOS on Nostr: There's absolutely nothing about this that's a horrible flaw and it's not exploitable ...

There's absolutely nothing about this that's a horrible flaw and it's not exploitable for any real attack.

Google does include carrier apps which get activated based on the active SIM and add significant attack surface but this isn't one of those. It's always disabled and doesn't get automatically enabled like that. Google has previously given carriers a ridiculous amount of access on some of their devices but this isn't an example of that. It's a disabled demo component.