It mystifies me why the smartphone ecosystem is so insecure by design. Are there not basic IDS or exfiltration snitches that will pop-up on a phone to say "Hey this app just accessed your contact list and send encrypted messages to a dodgy server?