Do a search for "residential proxy" and browse through the results a bit, all claiming to own millions and millions of exits in the entire world. The malware could be from the manufacturer or preinstalled apps since all app developers are contacted to inject various SDKs into their code source in order to act as residential proxy nodes and make profits based on the target's internet. It's on phones, android TVs, routers etc. I wouldn;t be surprised if some of the devices we, as technical users, use are infected - who reads that TOS when updating apps anyway?