The Google threat analysis report doesn't say anything about USG involvement; that it was found on compromised Ukrainian sites, has code written in "native English", but also signs of LLM authorship. The Google report says the kit they found can't compromise current iOS, which is a capability you'd assume USG would have --- though it's important remember that "USG" comprises dozens of different buyers each with different toolchains.

Maybe this was the Fisheries Department exploit toolkit.

iVerify, which spun out of Trail of Bits and presumably knows what they're talking about, says it bears "hallmarks" of being connected to USG CNE work. I believe it. But the USG is on net a buyer, not a producer, of CNE tooling. Whatever a given service agency or IC arm buys, dozens of other aligned countries are also buying.

(And, of course, the non-aligned countries have their own commercial supply chains).

I expect the evidence for this claim is axiomatic, which is to say that you think it sounds good.

Webapps exist for a reason, they don't get all the special permissions apps get when fully installed.

at the very least use a VPN / more secure phone like a pixel with graphene

You keep doing you though