That is very true and often overlooked. You get Google and SELinux enabled and security domains and such and all is good except for that fact that there is this little brick stuck on on the motherboard running proprietary code, accessing any memory on the phone and talking to the outside world.

Maybe it makes sense for non-baseband enabled devices, tablets, phones with baseband chips disabled somehow (physically).