It would require a pretty advanced exploit for this.

Which is what Pegasus is/was

https://en.wikipedia.org/wiki/Pegasus_(spyware)

Not really