This is nothing new. It has always been understood that if an endpoint is infected with spying malware that encryption is useless.

Lesson here. Always flash your phone back to a known clean factory image. when you get in and then only install apps from F-droid, and don't include the baseband part of the flash cause that is a security nightmare.. which means no cellphonee funtion.. and in many cases. a non-booting phone (which makes it secure BTW :) )

Basically.. expecting you're cell-phone to be Secure is CRAZY unless you control the baseband firmware.

Apps like Signal, etal are ment to stop PASSIVE data collection.. If they are targetting you directly forget about using a smartphone.