Sounds to me like physical access is most likely. Your friend, or someone who knows them saw the message on your phone because you left it unlocked somewhere, and added it that way.
Option 2:
Autocomplete randomly added some weird stuff to your message without you noticing it, and your friend took credit for it, because that's the kind of friend they are.
Option 3:
Your draft got synced to some other phone or computer that you were logged in to that your friend had access to. Maybe you logged in on a device that they own or something, or maybe you aren't using any sort of MFA and they just guessed your password.
Option 4:
Carbon monoxide poisoning : https://www.reddit.com/r/legaladvice/comments/34l7vo/ma_post...
If you're interested in narrowing things down a bit, you could give more information about exactly which model of phone you have, what level of jailbreak that it's in, exactly which Android flavor you're running, the patch level of the OS, and exactly which text messaging app you're using (different carriers and manufacturers ship different default SMS apps). Also relevant would be the message you were trying to send, and exactly what got injected.