You need to exploit an OS vulnerability or use suitable baseband processor as a backdoor, facilitated by the cellular operator. To exploit the OS or an a service on it you need a network connection. You can’t inject through an ad if there is no browser or email if there is no client.

Yes, you can spearphish but this can’t mass-target French mobile users as the article seems to claim. France isn’t North Korea, not just yet.