How do you guarantee nobody will be able to snoop? Even big companies often fail at this, and well-known 'privacy' apps like Telegram are leaking IPs. They're supposed to believe some random nobody because you sell the service for $1000/month?
How can a drug lord trust your guarantee that you don't have a backdoor, that you won't work with the feds when presented with a warrant, or work with a competing drug lord when offered a little cash? Or that you aren't a simply a CIA/DEA front from day one?
Even if you originally have a perfectly secure product, you are selling them phones all the time, so you can compromise things even years after you start out. Drug lord wants the latest hardware (with gold plating and diamond encrusting, natch) so you have to modify/ship him new hardware, which you can compromise thanks to pressure from the feds or because his competition gave you a suitcase filled with $1 million in cash (or gave you an empty suitcase and said "if you don't, the remains of your daughter will be delivered to you in this suitcase")
That's why I think you'd have to be on the inside from the start, so they already trust you before you set up shop.