Don't they also have all kinds of backdoors setup on those phones?
a) they were collecting excessive telemetry for a long time, after this was exposed they claimed it was config error or something and patched it and additionally allow to disable telemetry in settings fully or partially I think. Though no malicious intent was ever proved it was not a good thing.
b) people found app with soft root like capabilities. Eventually it was discovered that it was a debug Qualcomm app left intentionally (and present in phones of other brands) and soft root possible only if attacked has physical access phone must have ADB installed (never used it so I have no additional details).
I think there was no other incidents in 2017. Overall it was not good but compared to what can be extracted from Google (and that stuff can't be disabled and present in every Android phone) or other apps that many users install (FB, messengers etc.) it is just drop in the ocean. Not a secure phone but neither are any other mass market phones including Apple (who had degraded their security to a simple pincode - https://blog.elcomsoft.com/2017/11/ios-11-horror-story-the-r... ).