Also for iPhones it's usually iMessage instead of SMS which supposedly is e2e encrypted.
Also for iPhones it's usually iMessage instead of SMS which supposedly is e2e encrypted.
And even without that if you get an RCE within the context of a messaging app you might be able to get most of what you need since you probably would be able to read / write arbitrary memory within the context of that process and interact with which ever APIs the app has permissions for which for messaging almost always includes microphone and camera and often location too.
The only thing you don’t get from running an exploit within the context of a single app is usually persistence but if your exploit can survive the app being suspended then as most people rarely reboot their phones you can get pretty long lived sessions too.