Until the AMSS in the hotspot is compromised and used to attack your Android device via wifi.

This applies to mobile hotspots built around Qualcomm baseband/application processors, in other cases you would have to exploit the main CPU first.

Well, at least that requires two exploits/backdoors, instead of one.