I understand what you are saying, but seriously, the best way to get an exploit like this onto an end-users phone en-masse is through a third-party sdk. If a government pressured one of the companies behind the major SDK's to include this spyware as a form of backdoor, perhaps they would be forced to oblige.