> Heard some Chinese companies sell phones with ad injections in default apps.

Don't need Chinese companies for that. When GDPR came into effect I received privacy policy msgs from adware (Foursquare) inside my standard Samsung Image Gallery. Not only Google, but Samsung as well is a horrible privacy nightmare.