Seeing this post again made me think, apart from my previous reply, about something else.

I think your “popularity of software” argument is great because it probably holds true, in that an investment in finding an exploit has larger returns if the exploitable software is widely used. But rather than thinking in terms of apps, we could think in terms of operating systems. What if the vector of infection is not an app and rather is an OS? This is perfectly possible and there are massive incentives to find such exploits since this is not app-dependent.

This means that merely using iOS or Android in any capacity (either through Lineage OS or perhaps even Replicant) could be enough for infection. And so far, not knowing what the vectors of infection are for Pegasus, this is perfectly possible.

Perhaps using Linux OS is a good idea, given it’s not as popular.

Also make sure to power down your devices regularly as to flush the temporary memory (provided the hard drive is not infected)