Yep, tho the same power applies for a lot of an operating system so I see a basic level of trust for the developer as a prereq for even running the OS. If I didn’t trust the dev enough not to silently turn features into spyware then I’d never run the OS at all, personally (so anything Google makes is a hard pass for me). People should always follow release notes and be reevaluating their trust ofc, but if you’re actively expecting malware to be slipped into your shit I personally just wouldn’t give them the chance