Actually, no, I now remember this was about iMessage specifically and how it isn't completely isolated/runs as system service or sth? Or about the renderer?

Which would make sense because these attacks seem to exploit the same weakness.

iMessage's attachment renderer is also sandboxed, actually. You might be talking about this vulnerability: https://projectzero.google/2021/12/a-deep-dive-into-nso-zero..., but the second half of the vulnerability exploit chain was finding a way out of the CoreGraphics (Apple's image rendering library) sandbox to hack the rest of the system.