Note that tech news is biased towards flashy or relatable security issues. Nobody is going to n-day your phone (though you should, of course, keep it up to date). It's your Drupal you should worry about.
With that said, there is a long and proven track record of attacks on phones.
But those tend to be against journalists and activists.
What threat model you operate under is a nontrivial problem.
Nowadays I tend to more rely on tech news to hear when there's an actual serious vuln I need to address.
(Note I'm not advocating everyone do this. Do your own risk assessment).