How zero-click ad delivery and expired dependencies dismantle conventional mobile security assumptions.