Maybe an attacker triggers this protocol not to install a malicious update but to bypass FaceID/PIN/TouchID and then they can add whatever spyware they want. -

Maybe an attacker triggers this protocol not to install a malicious update but to bypass FaceID/PIN/TouchID and then they can add whatever spyware they want. - Trigger update via "special pad" - Interrupt update process to get access to phone - Wirelessly transmit spyware onto target's phone