We have been studying many different types of spyware, and the most advanced ones allow persistent access to a target's device, which, in turn, allows them to do anything on that device, and more than a user can do without the user knowing. Some of the latest versions of this spyware employ what's known as zero-click versions, meaning that there's no need to trick a target into clicking on a link of a fake message. A user, a government client of spyware, can simply issue a command to take over any device in the world that's vulnerable to this type of exploit.
Once inside a device, you can intercept and listen to any phone call. You can read emails and text messages—even those that are encrypted. You could silently turn on the camera and microphone; you can review all of the contacts; you can alter files on the device; you can access a person's cloud account; and you can track their location. It is extraordinarily powerful surveillance technology.
Keep in mind that we live in a different time than even 20 years ago, when a wiretap was something you put on a landline, or you'd place a bug or a GPS tracker in a suspect's car. This gives you all of that and more, because these devices are designed by their manufacturers to be as invasive as possible. They're designed, as well as the apps contained in them, to track every aspect of our lives, so this is a gold mine of information that is available to clients of spyware.