The vulnerabilities allow for code execution in the context of the Cellebrite application via the parsing of a video file. It doesn’t matter what the application was designed to do, you can now make it do anything you want just by getting it to scan a phone with a malicious video on it.

Yes. So Cellebrite should be writing the data to write-once storage prior to performing any analysis of the content.

In absence of write-once media, they are betting that the hashes they capture will be the same every time they image the device because they never modify the device.