Infosec News

Basically, the secure boot process of your smartphone ensures that only validated software has been loaded. The chip itself validates the bootloader, which validates the kernel, which then successfully forces validation on every app that gets loaded. Most exploits work by corrupting memory or injecting code that shouldn’t be on the system. By rebooting, you are forcing a revalidation of everything that runs, which is going to exclude the attacker’s code unless the attacker can come up with an additional bug to bypass the validation on boot. Any software that doesn’t have a valid digital signature from a trusted source simply won’t get executed.

You can see this in the jailbreak scene on iPhones. Jailbreaks are classified into tethered and untethered categories. A tether jailbreak is such an exploit that can inject code but can’t survive the validation process upon reboot, so it goes away, meaning the user has to tether to a computer and repeat the process every time. Untethered requires two bugs: The bug to inject the code, and the bug that dodges verification and is capable of injecting code when the system is starting. There’s also a class of jailbreak called semi-untethered that goes away when you reboot, but it’s possible to exploit again manually by the user using tools left behind on the phone, but the same basic principle applies that injected code goes away upon rebooting unless you have another trick up your sleeve.

if your phone compromised, chances are the code is running in volatile memory , a reboot would clean such infections.

My uneducated guess is, some threats will burrow themselves in active memory but have no way of persisting beyond a reboot. Or perhaps it just shuts down background software you don't need that could be vulnerable.