Oggyo Thanks for the heads up, I had seen there was QuiKSMS too when I was deciding what to test.
Random chance? choose between an older, stable app with no recent updates but has/had a lot of users ... or a fork with a new developer. Which one do I trust more? I have no way of knowing.
This is one reason why I stick with the default apps. I find the whole ios/android app ecosystem a bit Wild West really. How can folk know what to trust? I admit Linux might be no better or worse if you are not careful. I trust my distribution but wish I had the SElinux skillset to get Linux working for me in the same way AOSP/GrapheneOS does its stuff. I think Flatpak is aiming to do this sort of thing but I've not been there yet.
Nice thing with GrapheneOS is that I don't mind trying something out in a secondary profile:
- install app, disconnect from network/wifi,
- go into the AppInfo > toggle off all/most permissions especially network and storage.
- Open up app, play around to understand it then uninstall or disable the app.
In this case I was able to learn all I needed about QKSMS (and solve my problem, yay) without ever connecting the phone to a network whilst the app was enabled. Because of the option to backup SMS I decided to just disable QKSMS rather than uninstall it.