yup. if you're running untrusted apps on your phone, make sure to turn off background refresh AND notifications. apps can run arbitrary code when they receive a push message. usually its so they can provide a better notification for the user, but they can collect data and phone back to the mothership too.