Suppose the following scenario:
- User gets an Android device;
- User created Google account, not enabling any "sync"s or "backup"s;
- User inserts a SIM card with contacts;
- User copies then to the "Phone contacts", not to Google account;
- Users installs various programs that does not request permission to view contacts, root or contain exploits.
Are the phone numbers still secret from the Internet in general and Google in particular?
Has somebody experimented (monitored all traffic of Android device, including encrypted) and confirmed or disproved this for particular devices, Android versions and usage scenarios?
How do I proof the device from vendor-installed backdoors that can "mistakingly" send my data on opportunity; for example, if user never rooted the phone, not over Wi-Fi (which user can monitor), and when there is legitimate mobile traffic?