[onion2k]

once you mass-exploit it, they are gone

That is only true of exploits that have obvious and visible impacts, right? If an attacker found an exploit and used it to put a rootkit on millions of phones, but did nothing with that rootkit and it had no outward markers, would anyone know?

[rvnx]

Yes, probably the backdoors that security companies implement on the phones to exfiltrate and sell data would reveal that.