Yeah, it's pretty disingenuous reporting / [intentional] misunderstanding to sensationalize headlines. I'm sure many dozens of hours of work went into each of these, more likely hundreds. It only impresses people with no familiarity with this type of thing.

No it's not. The timings represent a good proxy for how easy it is to pull off the (weaponised) exploit in the wild.

For example Flash, even when sandboxed, continues to be an extremely easy and lucrative attack vector (relatively speaking). Four seconds puts the exploit in drive-by territory.

A sixty second web exploit is not so useful for "cyber" criminals. But if you can "compromise all aspects of the phone including contacts, photos, messages, and phone calls" in 60 seconds, this is probably worth it.

True that the headline is grabby, but if you are trying to pwn someone's phone, the speed of execution is important, right? "Hi, can I use your phone to call my mum? My phone's battery has died. I'll be back in 45 minutes..."