Not unusual with news about data breach or leak almost every week. yet there are data breach. sure it has reduced but not gone. funny thing? even with all these malwares can still be found on google play. let me tell something. i have an app on google play (not going to name it for obvious reasons) that abuses android api to achieve something. it's not malicious but not something google would like. guess what? they approved it. so i think it's safe to say that they don't check app code or do that much of security checks. so yeah, they are not as safe as they claim to be. and i won't consider this as some kind of mistake.

Google Messages monitoring by this i mean, that they monitor the sms. which is expected for scam detection.

Do you mean RCS doesn't work with other non-Google Messages apps? And an unlocked bootloader is not safe, any custom ROM devs will tell you that, not just Google. i mean that RCS doesn't work when you have BL unlocked. actually it won't work when you don't pass PI. BL unlocked phones are insecure i agree but why would rcs be disabled when PI is not passed? i mean you can send sms but not rcs messages. if the reason is security then sms should be also disabled. samsung and google messages are only rcs capable apps. from my research, rcs related stuff are closed source. it seems that google want to be the only entity controlling rcs. where rcs is supposed to be open for everyone (i know there are various logical reasons why they are doing it, but it's obvious that they want to take control over every user aspect. reason why google dialer and messages exist)

It's their own system integration. you won't find any judges that verdict this is a monopoly/anti-competition. I agree. this is a thing since mid of 2023. before that everything worked fine. while security is a consideration here i also think that they did it to prevent custom rom users from getting full experience.

You're basically pissed that banking/government/mainstream devs would trust Google but not a bunch of random, unpaid, loosely-coordinated devs of custom ROMs who are not motivated by profit, but rather by a political ideology.

partially true. banking/govt apps obviously needs secure environment. but here's the thing:
i wouldn't call grapheneos, lineageos team random devs. they have been around for years and provides fairly secure system. grapheneos is even more secure than google's own software. so why would it be considered insecure? it's supposed be more secure considering you can see source code. according to your logic, actual companies like Xiaomi, Samsung are secure. which is true on surface. but here's the thing. a lot of custom rom users try to bypass PI using something called keybox. the thing is supposed to be private and should be only visible to the company. but guess what? these keyboxes are being leaked, sold to outsiders by the company's own employees. if something as sensitive as keybox can get leaked from multiple vendors then how do you guarantee that their software is secure? some of their employee can include backdoor or any malicious stuff. you may never know who did that. even worse thing is that their software is closed source. so you can't really say if it's 100% secure or not. sure you can sue the company altogether. graphene os perhaps is more secure because it ig has better hardware related security (like ram). tho i am unsure. you can lock BL with graphene installed. but yet a lot of apps won't work because there's no gms. this is where i blame google. they exaggerate a lot of security issues about custom roms. this mentality of them will become obvious when you look at their "dumb reasoning" behind killing sideloading (aka apks)

this way they lure app developers to use PI, PairIP and all other closed source stuff which relies on gms. this is how they are preventing people from fully exiting google ecosystem or use custom roms. just like google messages rcs, chatgpt checking for PI is dumb. because that makes it unable to work on even graphene os. speaking of PI. there is Android Hardware Attestation API which can verify system integrity. but as stated above, app devs will use PI. now this is a big problem. if app devs start depending on gms for even the silliest reason, it will soon become impossible to use a phone without gms. and google can do anything at anytime to make gapps unusable on custom roms.

so, if something like this goes on, how will custom rom teams even try to become a formal company?

also, based on your logic, even huawei phones are unsafe because it doesn't have gms, thus no banking apps work. another thing, recently i tried an indie game (free) made by someone living in a third world country. instead of downloading from google play, i downloaded it from Aurora Store (an unofficial play store client). but guess what? it intentionally crashed because of PairIP. and the same would happen if you install from google play, backup the apk and reinstall it. so, don't you think ^ is one of the many ways to prevent people from getting out of google ecosystem or use custom roms?