Rapid7 reports a major OxygenOS flaw letting apps steal SMS data without permission, putting OnePlus users at risk.