A sufficiently determined user (and these are often national governments) could easily target a phone they control. With sufficient monitoring and logging they

A sufficiently determined user (and these are often national governments) could easily target a phone they control. With sufficient monitoring and logging they could grab the exploit directly. The only thing stopping them is whatever contract/“EULA” they signed agreeing not to reverse engineer the product, and I doubt the big spooks would care about such a thing.