> That sounds like an NSO-level attack, right?

Not really, these are available to any script kiddy as long as unpatched phones and software exists. It takes some initial effort to find them out, but that is it.

And I remember similar attacks floating around few years ago even outside domestic violence situation.