I have worked on this professionally; it's quite hard. Even getting exploits off of non-honeypot devices is hard. Setting up a honeypot adds even more complexity, especially because of how much fingerprinting attackers do. Before sending the initial payload it's likely that your phone OS, hardware model is already known–they're critical to deploying the exploit. Rough geographical location, who you've been around, which one of your devices is being targeted–all of these are not that hard to get. Once you're on the device and have elevated privileges you can run even more checks!

Yes, but surely getting exploits off non-honeypot devices shouldn't possible in general?

Surely it should only be generally possible if you have special monitoring.

Exploit authors are not perfect and sometimes they leave traces behind in accessible places that can be found if you know where to look.