Google Warning: Millions of Android Phones Come Preloaded with Malware
forbes.com
forbes.com
With the whole poor security of the SmartThings stuff, I have serious doubts about Samsung's ability in software. Their online services were dire, no SSO so I had to frequently re-login when I moved to a different part of portal, errors here and there.
This is why you should flash over the phone's OS with something AOSP-based the moment you get it.
Ideally you wouldn't install Google Play Services afterwards, but if you do you have at least upgraded to "possibly insecure" from "definitely insecure and probably malicious".