Supply chain attacks to computers have been documented in various countries. I don't think attacking the iPhone's NAND is practical, though, as it would also need to somehow bypass the signature verification system of the CPU, and even then everything on the chip would be encrypted before it hits the flash.

It's possible that there are bootloader exploits, but fortunately you can't beat these devices as easily as you can on PC.