It's fairly easy to open up a phone and probe inner circuitry.

I suspect that'll be the next step for malicious actors. I doubt very much the phone is fully resistant to having malicious data injected onto various busses.