[Magisk] co-brah:
Perhaps the irony which expressed this idea also allowed it to escape notice? Isn't this an important question?

Why should we trust the collaborations on XDA or anywhere else?

Some say they trust themselves to have the knowledge to validate their own security and therfore should ...

But THIS is the great Libertarian conceit, the idea that the negative consequence of any decision can be contained to those that choose it. This idea does not hold up, as demonstrated with the issue of public education. If I choose not to educate my child, or simply cannot afford it, not only will my child suffer. My community and society will lose the potential that education could unleash, and suffer the chaos that ignorance brings. Often, confining consequence to the decision maker requires rules that are enforced by some human agency. True political liberty requires a system of justice enforced by government power. Else there is a descent to the law of the jungle where the strong exploit the weak and survival is a constant struggle. Human beings, who alone among animals possess reason, can do better.

Nobody has devised a perfect method of maintaining cybersecurity. Any device that connects to the internet is vulnerable to unknown zero-day attacks. Even only installing updates through an air gap, like at Solar Winds, leaves it vulnerable. And a compromised device can be used to compromise other devices in its network. This is why employees often can't BYOD, and why corporations like Verizon are uptight about unlocking the bootloader. The assurance that...

...seems silly to me. Am I missing something? A compromised device isn't benign simply because the owner signs an agreement. It is naive to expect trust automatically from those repsonsible for protecting mission critical systems. Simply claiming you understand the technology better than they - and defying their rules - won't develop trust.

And finally it seems nobody has mentioned a couple of important reasons for allowing this cat-and-mouse game:

As this process plays out, the technical detatils of fix and counter-fix are publicy available, here on XDA. This serves as proving ground for security innovations. For example, the struggle to unlock Verizon's Pixel 3 revealed an exploit that was quickly fixed, and further efforts failed. In the end, Verizon won, and the game has given them the reputation of having devices that cannot be MODed. Some consider this an offense to their liberty, but for many it is an assurance that their rightful property will remains theirs.

XDA does not require the software being offered to pass any validation or security checks. Sometimes there is just a dropbox link with no checksum, and lots of encouragement to install it. Tricking a user into installing spyware is a common ploy for cyber attackers. But often this requires causing them to trigger a vulnerabilty, like those early virues that were secretly installed merely by opening an email message. Convincing a user in pursuit of some feature to cooperate with installing the spyware is even better than tricking them. If the user is happy with the ostesnsive "MOD", they will keep the spyware and come back for more. Does this speculative scenario really happen at XDA? I only know that it is quite possible and have no way to be sure it IS or IS NOT happening. Do you?