My guess is his iPhone was backdoored through Pegasus.

I would not trust my communications to be 100% secure unless it was software I wrote or audited using already established crypto libraries only on devices that are specifically isolated for this purpose

Research baseband processor backdoors. Apparently graphene has this covered..

Frequently Asked Questions | GrapheneOS