What is the security risk of an Android ContentProvider with android:exported="true" and no android:permission set?

• A.A) With exported="true" and no permission, any installed app (regardless of privileges) can query, insert, update, and delete data in the ContentProvider; this exposes all data the provider controls (contacts, messages, files) to unauthorized apps without any access control verification.
• B.B) Without android:permission set, the ContentProvider defaults to the INTERNET permission, limiting access to apps that can connect to the internet.
• C.C) An exported ContentProvider without permission is only accessible to apps signed with the same signing key, providing implicit protection.
• D.D) Android requires an android:permission to be set for any exported ContentProvider; without it, the manifest fails to compile.