I think you're magicalizing something that's pretty technically straightforward. They don't magically teleport into the phone. The AI chip (NPU) is just a chip...like the GPU and CPU. For pretty much all users this is a non-issue. For folks worried about being targeted specifically by a 3-letter agent, they (should) assume any device with a chip is compromised.