> That is simply impossible if an actual executable is installed on the device.

There's one exception, if there's a vulnerability in the hard-coded ROM or the silicon itself. One was found not long ago and enabled newer iPhones to be jailbroken. It lacks persistence and requires lightning port access, but it can't be patched.

A no-click remote ACE at the unpatchable physical level would be the mother of all zero days, and too valuable to use for all but the highest of targets.