We know, from multiple leaks, that clandestine services from multiple countries, including the US and China, have supply chain attacks, where they intercept computing equipment and install hardware backdoors into it.

Intercept an iPhone, replace the 128GB storage with a 128GB storage and some extra rootkit. Or anything else really.