I am a pentester and i have tried to Crack my phone(6T) several times. I could not find a loophole. While I have not tried cracking android 10, as it is still in development phase. Also please cite the sources when you are leveling such allegations as company sue you for defamation. Please stick to official/trusted sources while citing them to avoid spread of false News. About the user data I believe you are referring to data uploaded to various server even if their apps are not installed (big conglomerates who invade privacy!) it is done on AOSP level and hence not really a OOS flaw. All android phones do that, they say it is for smooth services but who knows