deepspeculator said:
Your main carrier sees that your sim card connected in foreign country using another operator. And they have all information about details of this connection (enough to locate it, and some operator APIs for IoT SIMs even have easy way of locating connections of your own sim cards as a feature provided to the users), they see contents of sent and received SMSs (e.g. bank verification codes could be important for shady operator), connections you made (to whom and how long they took), how much internet data you uploaded and downloaded etc. This is on the lower layer than internet connection (as this is on cellular connection layer), so VPN will not help with it.
Often your internet connections go through your main carrier proxy, even when connecting from abroad with different operator (you can verify this by using some IP-location tool when you will be abroad - most likely it will display IP from your main country and location in your main country, as traffic will be exiting through your main operator). So, while your connections through the internet will be encrypted by you, this also provides some interesting metadata and additional attack surface.
This is all in normal setting with normal operator. In situation when you are using shady operator and they will try to hack your device and succeed, of course it's much worse.
Click to expand...
