Yup. GOS can't save you when the backend is inherently insecure. Most countries have data retention laws. Carriers log your calls and texts and can also listen to your conversations when ordered to. But even when your adversary cannot issue a subpoena to the carrier there is SS7 system used to redirect calls, and access to that can be bought by hackers via third world countries. The only thing GOS can protect you from is cell tower spoofing as it has toggles to disable 2G and enforce LTE/5G which are more secure. But those types of attacks are rather primitive and not used much nowadays.