"-1" is not just hypervisors, things like Intel Management and AMD Platform Security Processor can peer into system memory. I have no doubt similar system exist on ARM, I suspect the radio transceiver can also read system memory and read secrets out of the security devices.

I don't think modern phones are trustable devices. They are opaque blackboxes, pretending to have high security but this security only really protects the spyware operators from being notices.

I don't think it's coincidence that the most "secure" and "private" operating system only operates on a very narrow model selection of phones from just one manufacturer. Probably because they have the best technology to keep the inherent backdoor invisible and implausible. A backdoor to a system nobody trusts wouldn't be very useful.