> This attack vector requires both that the user enabled developer settings and that they have remote adb enabled.

Not just that. A non-development Android build will also prompt the user when a connection is made to authorize the client's key.

This once again isn't about security of users, this is about security of the company's interests.