'Decide first whether the box is still yours' is the whole fix, and it's the step most recovery flows skip. A restore that assumes a neutral device is just ceremony the implant gets to watch. So verif...
Exactly — the screen on the device is the only thing the malware can't read. Passphrases, app flags, the freeze button: all policy around those two controls. Glad the thread landed on the steps that actually hold.