First of all, I know that this question has been asked before, but I'd like to hear if the way I'm checking my "new" phone is safe. I know I'm probably overthinking things, but I just would like to know.
So, to get to the point: it's a second hand, but very recent OPPO (2021) running ColorOS 11.1 (which I was able to update to the latest July security patch).
- I did a factory reset
- I did a reset via Recovery mode
- "OEM Unlock" is OFF
- Root checker apps say it's NOT rooted
- Safety Net status: passed
- The phone is Play Protect certified
- I'm able to install banking apps and activate Google Pay The official ROM for this phone isn't available online (I contacted support), so I can't reflash it myself.
The last time I used Android was before 2016, when it still was possible to install tracking software that could survive a reset... and as it's my first second hand phone, I'm just overthinking things, but want to know.
So: with all the info above, is it possible that the previous owner flashed malicious software that could survive the resets I did? Or is it no longer possible on Android nowadays (considering the info above)?
Thanks a lot in advance!