Granny isn't installing unsigned binaries on her phone or rooting her phone. Don't bullshit us.

The reality is we don't need to fucking remotely rootkit someone's phone to scam them. This isn't how the vast, vast majority of scams are done.

Relying on client side trust is a recipe for disaster, any anyone even kind of technically minded should see that.