Pegasus spyware took advantage of a very old x-pdf reader, this allowed for executing assembler code (yes that very old way of programming) inside of the phone’s sandbox until it could escape the sandbox by creating an actual vm with it’s own registry inside the phone.

So it it possible to hack anything? Yes. But easy? not at all.