At WWDC Apple revealed that their “Car Keys” feature would work 5 hours after the phone has died, so you don’t lose the ability to access your car. They didn’t

At WWDC Apple revealed that their “Car Keys” feature would work 5 hours after the phone has died, so you don’t lose the ability to access your car. They didn’t announce new hardware that could do this. It’s available in every new iPhone. This is proof that this capability (to run software even when the phone is “off”) has been around at least for a number of years. It’s not a huge leap to imagine that some malware could rewrite the firmware and enable e.g. microphone listening when the phone is off.