My wife lost her OnePlus 3T and after 4 days it's returned by a passerby who found it.
Not to sound paranoid, but is it possible the phone was flashed with custom ROM but retains all the data? Can someone be possibly stealing data / eavesdropping on the phone this way?
If I go to about device Android version, kernel version etc still shows the same information.
Is there any checks I should perform to detect any other malicious activity?