You don't know that netstat isn't lying to you.

http://wiki.c2.com/?TheKenThompsonHack

That sounds like paranoid talk, but I assure you, its not.

You've taken a lot of steps and hard work to be safe. You probably are safe. But let's be honest, you are safe because nobody has taken an active interest in you. I've gone to that much trouble before. I used to think all my fancy security measures worked. They mostly do, against average threats. I wasn't facing average threats.

I'm over 50 and I've been doing this a long time. You might hear that and think "Dinosaur Luddite - wake up old man...", but I'm not. I don't code in COBOL. I've stayed up to date with skills and I love technology. I've got nearly 40 years professional experience. I started coding at 11, but I didn't make money from it until I was 15. As smart as you are, imagine how smart you'll be at my age.

Despite my best efforts at doing things like you describe, I found out I was being observed anyway. That's the most I can tell you here.

After a while, playing electronic defense became too much work and wasn't effective against the threats I was facing. It was a LOT less work and more productive to put the phone in a metal box. It's a complex problem with a simple solution.

I've taken a couple simple steps, and I'm 99% sure I'm safe. I'm safe from the average hacker, and perhaps from a state-sponsored actor. Perhaps.

I'm not worried and for an app developer I'm suprised you took such a backward approach.

Surprise is a valid reaction. You decide if I'm crazy or smart and do whatever you like. But, if you aren't worried, you are naive. Look into this a little closer and see how far the rabbit-hole goes.