The capabilities depend on the specific exploit but if you're dealing with something like Pegasus, the answer is yes to almost all those questions.

> I wonder if there is some resource where people can read about how to detect and avoid such exploits and protect against them?

Protecting against the cutting edge of current nation-state attacks [1] is... well, it's not impossible but it's up there. Just don't be important/interesting enough to catch their wrath is the TL;DR.

That said, see: https://docs.mvt.re/en/latest/introduction/

[1]: https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-i...