Random
The "burner" phones at garages, marts and other locations are generally loaded with spyware/adware/clickfraudware/etc.
The worrying thing is not so much that they are blatantly gathering personal data but that they then send said data back to the mothership using the 4G
or Wifi which is not cheap. That 10-20MB a week can make all the difference especially with things like background downloads.
I used to have a phone which despite multiple wipes and resets kept downloading demented adverts the second 4G turned on.
Usually its the M***at*k ones but some others have been known to hide nasties in the firmware, or update to NastyOS V6.66 at a later date, or simply load the firmware with a usage trigger so after so many days of use or so many GB of mobile usage it "Updates"
Hint: when it says it is running Android Vwhatever. check to see if Twitter works. If it does not then the phone is lying to you!!
The normal symptom is a page security warning.