Most people either need to pick a level of trust and use a device as it is, or not use the tech. This isn't an elitism argument; I know something about software but if it comes to medical or legal matters, I'm in that same boat. Yes, we can educate people about the threat vectors they don't understand exist if and when they're relevant, but trying to make individuals responsible for the security of their mobile phones via verifying their software stack is like making me responsible for the safety of the drinking water coming out of my tap.