Many Android devices ship with firmware vulnerabilities, researchers find