Protecting against these vulnerabilities involves a lot more than just the OS. On this topic, see this incredible multi-step exploit from Google's Project Zero team, which goes from exploiting the Wi-Fi firmware to eventually gaining read-write access to the entire memory: https://googleprojectzero.blogspot.com/2017/10/over-air-vol-...

> During our research, we explored several components, including Broadcom’s Wi-Fi firmware, the DART IOMMU, and Apple’s Wi-Fi drivers […] We’ve also seen how the iPhone utilises hardware security mechanisms, such as DART, in order to provide isolation between the host and potentially malicious components.

Companies like NSO Group are certainly capable of developing exploits of this complexity, as Google's team has shown. Their analysis of NSO's FORCEDENTRY exploit showed NSO building a mini-VM from scratch within a little-known image codec used by the iMessage PDF engine: https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-i...

It is extremely difficult to defend against teams that have this amount of skill and dedication.