I’d consider it unlikely that Google or Apple put anything like that into their phones on purpose, because of the reputational hit if it came out. But, new vulnerabilities are being exploited every day. And don’t forget the need to protect metadata.

Do you know the movie Citizenfour, a documentary about Edward Snowden? During its production, if the filmmakers wanted to discuss something sensitive, they would leave their phones in the office and go outside to have their conversation without them. There still might have been listening devices around, but they did what they could about the phones.