"Of course they can. Even the iPhone, Apple can easily push an invisible update and install a bot on your phone"
... or on your SIM card, which is a full computer with CPU and memory and can run arbitrary java programs that your carrier can upload to it.