@dushman Riddle me this.

If you only install free software via f-droid on an replicant device, what insecurity replicant software wise is there to exploit?

Sure such mobiles can be completely compromised via the mobile chipset (maybe not the main processor that easily on newer mobile devices since IOMMU, but has any IOMMU implementation ever been audited?), but that's true for every single tracking device.