everything done from the phone is linked to who purchased it...

Can't zap you 🤔

But how do they link what is done on the phone to IMEI. As I see, apps can only get this info with special permissions permissions: "Android 10 (API level 29) adds restrictions for non-resettable identifiers, which include both IMEI and serial number. Your app must be a device or profile owner app, have special carrier permissions, or have the READ_PRIVILEGED_PHONE_STATE privileged permission in order to access these identifiers."