Given that almost all early iPhone OS and iPhone have bugs and vulns that allow jailbreaks and carrier unlocks, it's completely unsurprising that the NSA had a 100% success physically.

For example, iPhone 3GS released in 2009 can be jailbroken with 2010-era latest iOS 4: http://www.iclarified.com/jailbreak/iphone3gs/mac.php?firmwa...

I don't think you even need baseband access to do all the spying. I think all of that can be done on a jailbreak.

I can't find the exact "100% success" quote to put it into context, but for one thing, it's a six-plus year old document. It's possible that they had an exploit at the time. An exploit doesn't require Apple's cooperation.

The document also doesn't claim this success remotely (only "A remote installation capability will be pursued for a future release", which really gives no clue as to how possible that was or is). We've always known that pretty much any mobile device can be vulnerable with physical access (that's what "jailbreaking" you phone is doing).

100% success if you have physical access. You certainly do not need to be the NSA for that.