I wish I was this naive.
Even AirTags receive firmware updates via Bluetooth. The iPhone when off has the capabilities of an AirTag.
If Apple wanted, they could. That's all I'm saying. If AUKUS & EU say "backdoor them or no more sales" you bet your safe encryption will be no more.