Good point. Although good hacking and manipulation can seem like it's a local compromise.
Or perhaps the automatic backup of the photos could have gotten decrypted? Shooting in the dark.
There are zero click zero days that are used all the time so perhaps the roaming sims of "hostile" countries are sent the zero click payloads.