Use your device itself to perform various nefarious operations such as participating in a botnet, posting fake news (even if under a different account, it's still your IP), host and distribute child porn/state secrets/confidential information, help mask the activity of hackers
At some point, a vulnerability in android will be discovered, and they will exploit that vuln to read stuff they currently don't have access to, such as your biometric data (you can't change what your fingerprint looks like, once that's leaked you're fucked forever)