Have you considered the possibility that many of the people you are talking to have things like degoogled phones with custom ROMs, while the remote is running a closed-source firmware that most definitely is spying on you all the time?
It definitely makes it a lot less likely, since you need to have hardware exploits (or some Android zero-days), which are rare, valuable, non-trivial to exploit, and only accessible to a very limited group of actors (CIA, very proficient hacker groups), so these will not be wasted on just stealing your data…
Have you considered the possibility that many of the people you are talking to have things like degoogled phones with custom ROMs, while the remote is running a closed-source firmware that most definitely is spying on you all the time?
If you think degoogling your phone is going to make it not spy on you, then it makes sense you would target your remote.
It definitely makes it a lot less likely, since you need to have hardware exploits (or some Android zero-days), which are rare, valuable, non-trivial to exploit, and only accessible to a very limited group of actors (CIA, very proficient hacker groups), so these will not be wasted on just stealing your data…