Low-cost Android phones can arrive already compromised, with malware embedded in their firmware before buyers switch them on.