Far enough down the threat model rabbit hole the real solution is just ditch the phone if you're doing anything mildly antigovernment. That at least forces them to do a bit more work to spy on you.

That's always one of the big issues in opsec/security discussions, we can always imagine a more motivated or well funded attacker but the likelihood of those being deployed against you change with the difficulty of implementing those methods.