There’s vulnerabilities like the recent iMessage exploit that are executed remotely through no interaction by the user. In combination with the ability to self-spread you get mass exploits like WannaCry which spread to 300k+ computers in 7 hours. All you need is a network connection.