Is Android Pie vulnerable to ADB server attack? According to The Hacker News, many Android devices are running insecure remote ADB service:

Thousands of Android Devices Running Insecure Remote ADB Service
Despite warnings about the threat of leaving insecure remote services enabled on Android devices, manufacturers continue to ship devices with open ADB debug port setups that leave Android-based devices exposed to hackers.
Android Debug Bridge (ADB) is a command-line feature that generally uses for diagnostic and debugging purposes by helping app developers communicate with Android devices remotely to execute commands and, if necessary, completely control a device.
Usually, developers connect to ADB service installed on Android devices using a USB cable, but it is also possible to use ADB wirelessly by enabling a daemon server at TCP port 5555 on the device.
If left enabled, unauthorized remote attackers can scan the Internet to find a list of insecure Android devices running ADB debug interface over port 5555, remotely access them with highest &quot;root&quot; privileges, and then silently install malware without any authentication.
Therefore, vendors are recommended to make sure that the ADB interface for their Android devices is disabled before shipping. However, many vendors are failing to do so.
[...]

Is Android Pie vulnerable to the ADB server attack as mentioned above?
The attack is unrelated to a specific Android version (including Pie, Q, and beyond), but to all devices with ADB over network enabled.

[...] it is also possible to use ADB wirelessly by enabling a daemon server at TCP port 5555 on the device.
If left enabled, unauthorized remote attackers can scan the Internet to find a list of insecure Android devices running ADB debug interface over port 5555, remotely access them with highest &quot;root&quot; privileges, and then silently install malware without any authentication.

This is made worse when some manufacturers/vendors ship the device with the setting enabled.

Despite warnings about the threat of leaving insecure remote services enabled on Android devices, manufacturers continue to ship devices with open ADB debug port setups that leave Android-based devices exposed to hackers.
[...]
Therefore, vendors are recommended to make sure that the ADB interface for their Android devices is disabled before shipping. However, many vendors are failing to do so.

For more information: Malware installed with remote debugging

To secure the device, check whether the ADB over network is disabled or not. This setting is available under Developer options, which normally also needs to be enabled first (usually by tapping &quot;Build number&quot; on the Settings 7 times)
To enable Developer options (in general):

Go to Settings - About phone
Tap &quot;Build number&quot; 7 times (or until any notification about developer option already enabled appears)
(If this step doesn't work, check with your device manual or other resources to enable Developer options)

To disable ADB over network:

Go to Settings - Developer options
Check whether the &quot;Developer options&quot; is enabled or not by toggling the switch on the top. If you don't need any features from this setting, disabling it is recommended. However, if you need some features from it but still need to secure the device...
Scroll until the Debugging section, and check whether &quot;Android debugging&quot; and &quot;ADB over network&quot; are enabled or not. Either disable both if you don't need to debug any apps, or just disable &quot;ADB over network&quot; to prevent this attack.
(Otherwise, if you need to use ADB over network, just don't forget to disable it when you end the debugging season)