Sorry if it was unclear the sources were in the comments. Phones have a baseband modem which is insecure, and easily hacked. This has just one reference, but basic search will show a lot. We also might write an article on it in the future.
nostr:nevent1qqsycye8ze4m6v4u6yk6myt4xprfphygzvkkfqwm7076e0gcv04nsncpzpmhxue69uhkztnwdaejumr0dshszyrhwden5te0v5hxummn9ekx7mp0qy88wumn8ghj7mn0wvhxcmmv9u9w9ec7
It says here the baseband has full access to memory and can compromise it unless IOMMU used, which all the devices GrapheneOS supports have, so it's not an issue