But if you have credentials and physical access you can just ask for their phone and straight up read their messages/apps.

Yeah, once, possibly under time pressure, and not at all times. Spyware gives you continued access.