… yet there's no known malware, and afaik Sailfish is quite up-to-date with security patches for CVE's. Unlike most Androids.

Also, who knows what they have coming? Things like full device encryption don't seem to be too hard using the default Linux tooling (which does beg the question why it still isn't in our devices). And Jolla was touting extra security features from the SSH-guys. Perhaps they sold that to Turing? Indeed it remains to be seen what of that is going back upstream.