pull down to refresh

Yes, this was Android, not a de-googled phone (or iOS), but yeah, as a rule, if someone has physical access to your phone for a time and you don't, assume they'll hack it.