The phone OS may be open source, but is the sim? The sim card can run applications directly without the phone being aware of it.