They can get into most phones for sure, and even if you have GrapheneOS in a paranoid config they can get you if they put in significant effort. They will come at the data from a direction that doesn’t require compromising the phone itself if that’s too much challenge. You need to think about the total attack surface, the phone itself is just one thing. Ultimately it’s about what resources are necessary to get what they want, for most phones the resources are relatively minimal but also most people are not worth the resources to them.