Sorry if it was unclear the sources were in the comments. Phones have a baseband modem which is insecure, and easily hacked. This has just one reference, but basic search will show a lot. We also might write an article on it in the future.
Discussion
It says here the baseband has full access to memory and can compromise it unless IOMMU used, which all the devices GrapheneOS supports have, so it's not an issue