Sorry if it was unclear the sources were in the comments.  Phones have a baseband modem which is insecure, and easily hacked.  This has just one reference, but basic search will show a lot.  We also might write an article on it in the future.

nostr:nevent1qqsycye8ze4m6v4u6yk6myt4xprfphygzvkkfqwm7076e0gcv04nsncpzpmhxue69uhkztnwdaejumr0dshszyrhwden5te0v5hxummn9ekx7mp0qy88wumn8ghj7mn0wvhxcmmv9u9w9ec7 

 It says here the baseband has full access to memory and can compromise it unless IOMMU used, which all the devices GrapheneOS supports have, so it's not an issue