I was talking about google/apple being able to inject arbitrary code into (almost) any phone via (eg.) google play service update or whatever apple has. Also microsoft with windows update, and many other companies too.
It's true that any any software that allows auto-updating can be used to load arbitrary code onto a system, limited only by whatever additional safeguards are in place. In the case of the OS vendor, that can't really be guarded against, but it exists farther up the stack as well. Chrome and Firefox can just as easily load nefarious code onto your computer, limited only by what the OS prevents (which is generally more on a mobile platform, thankfully) and what their own reputation can sustain if they were found doing so.
It's also not a theory.