From the specification it looks it can open a browser... combine that with an exploit for the browser...
If I were some sort of criminal and my phone's browser would open up after which I'd see the video / audio / gps icons light up, I'd be very suspicious.
Definitely. But I guess that it might be more subtle. The web page can show some benign message (let's say something related to your cell provider) and deliver an exploit to install a spyware like Pegasus. There would be no immediate sign of infection or suspicious activity besides the unexpected browser opening.