Didn't know/remember about KitKat verified boot, but the sandboxing thing was prob just to kernel & perhaps some system files, def not user or hardware such as cameras. Including between apps & phone contacts, etc.

And I totally agree about lack of Linux phones (as hardware), the phone market with its size & megacorp subsidies to preinstall spybloatware is a giant hurdle.

And the real reason for closed sauce drivers (as a practice, not as if they should open-sauce old hardware now - that's a security risk for unsuspecting folk & iot ... but we could def transition the practice).