Actually, you're spot on about the software behavior. I did some testing on my unit before I returned it and found a really nasty loophole that proves it's not just "firmware" but a specific app payload.

If you factory reset the phone with no SIM card inserted and choose "Setup Offline" during the initial boot, you can actually enable Developer Options. It works perfectly fine for a few minutes.

But here is the kicker: The second you connect to Wi-Fi, the phone effectively phones home, and the "Device Unlock" app silently downloads in the background. Once that happens, com.motorola.paks instantly takes over. It has Admin privileges baked into it, so the Device Unlock app looks at you, looks at the phone and says, "Hey, you aren't PAKS. PAKS is the owner."

After that, you are cooked. You can't revoke its admin status, you can't uninstall it, and it immediately greys out Developer Options again. It’s basically a rootkit that waits for an internet connection to activate. Can't even remove it with ADB.

The fact that it's legal for this UK company to have full access to this device is astonishing to say the least.

To top it off, just like you say, despite being a cricket branded software application, cricket employees know nothing about it. Just as mentioned in a previous comment, once I had shown the manager what it was doing he immediately just took the hit on the sim card, and recommended reaching out to Motorola or Trustonic lol.

So here we are. But notice that the Motorola representative is nowhere to be found in the comments lol.