>It feels like no real kids are testing the parental controls
I feel the same can be said about accessibility service:
Once you get the accessibility permission, you have FULL control over the user's device. They could just split those permissions and expose a more fine-grained control api, but they (I suspect) have some one, verry extreme use case in mind and design the service around it (like ie. phone user being completly blind and requiring the accessiblity app to be an interface for literally all interactions with the device).
Which means that whenever you want to use some feature of that api, you have to trust an app completely and give it a carte-blanche to do whatever it wants on your device.
Which ultimately leads to gigantic whole in platforms security, for no other reason then 'this is the way and scenarios we intend people to be using it, and we give no compromises for anyone who has any other usege in mind'
I feel the same can be said about accessibility service: Once you get the accessibility permission, you have FULL control over the user's device. They could just split those permissions and expose a more fine-grained control api, but they (I suspect) have some one, verry extreme use case in mind and design the service around it (like ie. phone user being completly blind and requiring the accessiblity app to be an interface for literally all interactions with the device).
Which means that whenever you want to use some feature of that api, you have to trust an app completely and give it a carte-blanche to do whatever it wants on your device.
Which ultimately leads to gigantic whole in platforms security, for no other reason then 'this is the way and scenarios we intend people to be using it, and we give no compromises for anyone who has any other usege in mind'