One is fly-by attacks by random viruses and ransomware. For those cases, I would not worry about pictures.
Other is when you are targeted by regimes with essentially unlimited budget. In that case yes, the picture can be a spyware.
If this was the case, exploits would never be published or abused, and jailbreaks wouldn't exist because this logic says that those who find exploits will either disclose them "responsibly" or sell them to a nation-state.
If the idea of non-state hackers doesn't bother you, recognize that organized crime is a billion dollar industry and fraud rings would love root access on tons of normal people's devices, including your own.
But nobody is going to burn zero days on mass surveillance. It’s just for specifically targeted people.
Negotiate big contracts? Work in aerospace or defense? Have access to inside information about a public company? Have access or are a high level political official?
If the most they could get out of you was a few thousand bucks from your bank account and maybe your email password, you're probably in the first category.
On the other hand, if you have access to highly confidential information (think classified government info or you're literally working on the next iPhone) or are the type of person who makes enemies of spoiled rich oligarchs in despotic nations then you're probably in the second.
Xiaomi, Huawei, Oppo, Honor... there are quite a few Chinese phone brands that would benefit from knowing what Apple are working on.
Think about Ukraine today, the Russian government would probably love to have a way to compromise millions of Ukrainian citizens’ phones.
These people all use iPhones.
A quick research tells me that pretty much all stats show Android use to be around 80% in Ukraine. Or did you mean Hong Kong? For the latter I see a 50/50 divide.
Just curious about that sentence. I don't think the stats take anything away from your general argument.