Also, if you have the Google Play Store then you have Google Play Services which auto-updates without user interaction or notification and has almost unrestricted access to the device.
Well, good thing that we have Android Police and their teardowns acting as a control, that way they'll spot something when Google pushes an NSA trojan to Play Services. /s?
