From the article:

>Apple devices were not spared scrutiny. Visitors’ iPhones were unlocked and connected via a USB cable to a hand-held device, the journalist said. What the device did could not be determined.

iOS is probably looked at as well, but has to be done manually since there's no way to just do it with a simple app.

I'd wager that they have a enterprise certificate to sign the iOS app with. Then it's a matter of sending the spy victims to a URL, installing the app and granting access to photos/ location/ whatever.

Nope.. the user would also have to open Settings and explicitly mark the vendor certificate as trusted.

It says the devices were unlocked then the device was connected. I would assume the device is in the custody of the Chinese authority at this point. Thus, they can just go into Settings and trust the cert.

Changing trust settings on device requires the password.

Better question is: what are they able to pull off the device while it's unlocked?

iOS too, they ask for the PIN so they can unlock and install etc