> The government is also keen to have these devices controlled more tightly.

Not to oppose what you wrote, but let me try to give you a different view on the same picture to support a different conclusion:

In the eye of most governments these devices play such a minor role that they practically don't even exist.

What governments see is messaging services, finance services, digital marketplaces, and so on. It was and is their job to do that. They used to regulate telecom providers, financial institutions, marketplaces in the past, and they are now catching up realizing that the carrier is no longer the messaging provider, banks are not in control of all finance flows, marketplaces exist beyond the classical physical markets, etc.

If you look at detailed regulation and laws, Governments still have little interest in the explicit devices, they still look at those new variants of classical services and try to adapt to them.

But what the PROVIDERS of those services do, is creating pressure on the devices to help them reach lowest-effort compliance for their SERVICE-requirements (--> "let's make the end-user device bulletproof trusted, so we can offload our responsibilities to his device").

This is in most cases why the devices evolve the way they do. Because they are a merge of product and services (often from the same vendor), and the product is evolving to satisfy the needs for those services.

That's why fighting for "ownership of your device" is mostly futile, because the assumed opponent in this fight doesn't even feel addressed.

You need to bring the fight to their topics, to the topics relevant for governments:

On how a citizen ID should be verified, how financial services should be realized, how a competitive market should be ensured also on digital markets, etc.