Replicant

if the baseband radio is spying on you, and the operating system is spying on you, and the built-in antivirus is spying on you, and the cloud servers that contain your data are spying on you, does that logically mean that the popular apps that you run are not spying on you?

1. what do you mean exactly with 'built-in antivirus'?
2. cloud servers should just contain your >encrypted< data
3. popular and just free (not open source) apps are often suspected to be not that good to your privacy:
   
   source: https://www.pinterest.com/pin/309129961898569453/

http://www.bbc.com/news/technology-34732514

AFAIK this is the original source: http://arstechnica.com/security/2015/11/user-data-plundering-by-android-and-ios-apps-is-as-rampant-as-you-suspected/
an this the related study: http://techscience.org/a/2015103001/

• Settings -> Security -> Privacy Guard
  to avoid the access of your selected (system and/or user)-apps to your contacts, calendar, geo-location, ...
• AFWall+
  to prevent your selected (system and/or user)-apps to send/receive data to/from the internet...
• DataStats
  to have an additional live-overview about your incoming and outgoing data-traffic

But probably I'm the wrong person to talk about that topic. I'm not using that kind of 'popular apps' (listed inside the study-link) and even don't have a Google account...

especially interesting is the tendency of android devices to connect to a domain called safemovedm.com
http://android.stackexchange.com/questions/104988/cannot-log-into-the-wifi-due-to-blocked-website-called-hla2-safemovedm-com

• use AdAway and add "safemovedm.com" over app-Settings -> Your Lists -> BLACK,
• or just manually add the two lines to your /etc/hosts file:
  • 127.0.0.1 safemovedm.com
  • ::1 safemovedm.com

Cheers!

Good on you for not having a Google account.

Android phones often come with a free antivirus program.
For instance LG phones sometimes come with Lookout; it cannot be uninstalled.

Regarding the cartoon, there is a saying: if you don't know the sucker is, it's you.

But probably I'm the wrong person to talk about that topic. I'm not using that kind of 'popular apps' (listed inside the study-link) and even don't have a Google account...

Good on you for not having a Google account.

• to get things (to you and other people) straight (in context of my whole answer),
• and to show, that using Android doesn't force you to have a Google account.

Android phones often come with a free antivirus program.

Replicant doesn't come with an antivirus.
(If you want to scan your user-data, just mount your internal and/or external storage as 'USB mass storage' and scan the mount-points with the engine of your choice, for example: ClamAV)

For instance LG phones sometimes come with Lookout; it cannot be uninstalled.

Hmm, am i right with the feeling, that you're speaking globally (about Stock ROMs), not Replicant related?
(What if you just got root on such LG phone Stock-firmware and simply kill the 'free antivirus' .apk file under /system/app)?

that is correct