That's pretty scary.

just wondering if examples exist where users have had their phones remotely hacked and keys stolen,

using it as a dedicated device *without their engagement.

that is to say

if remote exploits are an actual risk for the average hodler

or its in the realm of "theoretically possible but not ever gonna happen unless maybe if you're a known target"