Everything is based on trust. How do you know that your phone is not sending your browser history once per month at random time at night, along with random legitimate-looking service?
And you cannot really confirm the above use case very well. What if it is so sophisticated that it knows when it is being monitored, or it is so random or well hidden, that it might take years to spot.
We are just doomed.