A single OTA update would brick most phones in a couple of weeks. Taking advantage of any of the many zero day exploits would enable them to brick most phones in a matter of hours.

Via certificate invalidation, or turning off services for certificate pinning?