End-to-end encryption doesn’t protect the social graph. They already know who is talking to who; they just don’t know what is being said.
I don't think we're far away from court ordered wire taps to compel Google to enable the cameras and microphones.
With this kind of architecture, law enforcement doesn't need 0-days, they only need a warrant/NSL, or to just ask the manufacturer nicely. Some manufacturers (e.g. Amazon/Ring) are a little too eager to essentially hand all of their data over to the police in real-time with almost no strings attached.
Devices that don't already upload everything to the cloud (e.g. Apple and Google's pinky-promise that smart assistant audio is processed locally) automatically receive and apply software and firmware updates from the manufacturer / carrier that can arbitrarily change device behavior. The government can and probably does compel these companies to write and push custom firmware to targeted devices.
"We encrypt your data so hard that we couldn't access it even if we wanted to" is almost always a lie, is never verifiable, and is ultimately subject to the same automatic firmware/software update problem.
It will never be possible to secure systems like these from government snooping, and people largely don't seem to care.
Google also asks you if you'd like to update Android, and they currently let you turn off auto-updates in the Play store, but they push updates to their nebulous, infinitely privileged "Play Services" packages frequently and without asking or informing the user. Even if Apple doesn't currently do something similar, it would be foolish to believe that they're not capable of doing so, as an ace-up-their-sleeve in an emergency scenario.
Also baseband firmware is pushed by the carriers silently and is essentially unauthenticated.
You really, really, really should not trust your phone, like, at all.
"this app wants access to your microphone: YES/NO"