Yeah, you're right, you can open up a black box in a way you can't really for a typical phone app/OS stackup. Maybe I argue it's no longer a black box then, but no matter. I had originally started in on another section about better permissions and data handling and such, so I probably had a more optimistic view of permissions in general when writing, but one of the points was about being able to sniff your own (app's) packets to be able to monitor what's collected and sent at any given moment. That's the sort of thing that I think makes the most sense, to directly interrogate the issue of what data they are sending back about you, rather than making logical connections from other observations.

Counterpoint: It might be normal for that device to have a WiFi radio or something to communicate wirelessly, but if the software is actually using the antenna to detect and track your heart rate, it might require an extremely (or even impossibly) talented hardware engineer to notice anything fishy from the device's hardware itself. The WiFi and heart-rate thing specifically might not be a viable vector, dunno, but it can be a lot harder to check for stuff than just seeing if there's an "ACME Spy Microphone" module plugged into the board somewhere. Though I agree they would probably get a worse reaction from illicitly including a hardware feature vs an app scraping the same data from your phone, even if they'd send back the same info; also that you could at least know a separate device was only tracking your car's location, and only when you brought it with, not relying on it's own software to decide when and where to collect data.

Ultimately, the solution might have to involve not using an OS developed by a company that also wants to slop up as much data as it can, but only so much one can do. At the very least, it'd be nice to get more separation between a "personal space" that you live your life in, e.g. socialize and consume content, and a "functional space" for other stuff that will run on your phone or you access occasionally but isn't part of you being you, like apps for random companies or services, phone lights/sensors, a driver-insurance-safety app that should just get data pipes in from a specific list of sources and isn't supposed to be sending data home 24/7, etc.