Definitely. But I guess that it might be more subtle. The web page can show some benign message (let's say something related to your cell provider) and deliver

Definitely. But I guess that it might be more subtle. The web page can show some benign message (let's say something related to your cell provider) and deliver an exploit to install a spyware like Pegasus. There would be no immediate sign of infection or suspicious activity besides the unexpected browser opening.