He says this is a vulnerability in Whatsapp, rather than in iOS/Android- But if a full-phone exploit is possible using the app, isn't that inherently an iOS/An

He says this is a vulnerability in Whatsapp, rather than in iOS/Android- But if a full-phone exploit is possible using the app, isn't that inherently an iOS/Android bug? My understanding is that that an application should not have full access to the system. I would expect that even if it were hacked/acting maliciously all you could pull is what the app already has access to. Did they stack an iOS exploit on top of a WhatsApp bug? (Using WhatsApp for remote execution, then a privilege escalation of some sort?)