TPMs and remote attestation on all platforms. For example, there's no reasonable way to run an adblocker on Android without rooting, and if you do root, many apps e.g. banking apps will refuse to run. The feature is called SafetyNet.
* Rule number 1 in Distributed systems fight-club is never trust the client.
* Rule number 2 in Distributed systems fight-club is never trust the client.
...so why do they trust their client in a little-snitch OEMs soldered to the motherboard?