That's assuming the individual is even aware that they're the attack vector. Apps can easily write a suitable file to their private storage that will deliver a

That's assuming the individual is even aware that they're the attack vector. Apps can easily write a suitable file to their private storage that will deliver a payload. And now I'm wondering - since the exploit only requires that the bad file be parsed, couldn't you put an appropriate exploit in place just by sending the file via email, sms, or airdrop? As long as it's someplace Cellbrite will see and process it, you're good.