That's an interesting counterpoint, and one I hadn't considered. Definitely worthy of note (especially when you combine it with the 'zero Android vulnerabilities found' - which isn't to imply it's an actively nefarious project, but that everything should be taken with an objective eye).