Google wants to lock the front door. The broken window is on the second floor.

Platform security moves are easier to read when you separate the perimeter from the bug. CVE-2026-0073, an 8.8-rated authentication bypass in adbd that lets a network-adjacent attacker execute code as the shell user without any user interaction, sits in auth.cpp. The proposed remedy in the IssueTracker thread lives at the loopback interface, the place apps like Shizuku, Canta, and call recorders deliberately go to grant themselves privileges without root.

Threat models in mobile platforms keep migrating from "fix the code" toward "narrow the attack surface by restricting a developer affordance that was opt-in to begin with." The cost lands on accessibility tools, automation, and rootless power-user apps. The benefit lands on a less common vector than the one the CVE actually documents. When developer options already require an unlock tap and remote debugging already requires confirmation, the marginal attacker deterred by a loopback block is small relative to the apps broken.

The mechanism repeats: maintainer comment, security framing, perimeter restriction, code bug untouched. Affected users can leave specific, reproducible feedback on the thread. Kitsumed warns that noise will get it locked. That instruction is the most useful thing in the conversation.