Netzpoltik details that police are able to gain access in this way either through physical access to someone’s phone or by intercepting verification codes via a state-sanctioned phishing attack or intercepting SMS messages via telephone surveillance.
Literally every western (and some non western) country has bought and used Pegasus against activists and journalists, the virtually undetectable Israeli Spyware that essentially gives the state root access to your phone.This is small beans compared to it.