It technically uses various zero-day zero-click exploits to get there. Which is why it functions like a service - they need to maintain relevance of those exploits. Imagine, a whole service of clearly illegal activity, which doesn’t get absolutely destroyed simply because it’s useful to spy on dissidents.