I'm working on analyzing a similar compromise of Google-certified phones and tablets, some actively sold, with Triada and other malware, but have not yet been successful at reporting it to Google. If you know anyone who can get this to Google's threat intelligence team, send them the link to my report:
https://ethannelson-moore.github.io/blog/2026/10/25/maxwest-...