The CA certificates in a mobile device are what control it's internet traffic and the servers it communicates with. Doesn't matter what Samsung does once a malicious actor through a carrier who doesn't have oversight on these kind of issues, gets a hold of your certificate store your device is owned you can be tracked and it leaves users vulnerable and no one is talking about it or doing anything about it
