There's something of a long history of this sort of thing, with vendor crapware on PCs installing ActiveX controls that were marked "safe for scripting" that were anything but.

This seems to be yet another argument in favor of getting a "pure" Android phone, to be rid of these vendor things.