Don't need to have the app installed to do it.
Alphabets were caught intercepting hardware and directly installing code and extra hardware into routers etc - a physical MIM attack.
Perhaps that's why Q says "CHINA CHINA CHINA". What comes out of China? Nearly all electronic equipment we buy. So FB, GOOG, C_A, etc could have every phone, tablet, watch, router, etc infected before they even load the boats to get here. Hence, why Q says that even uninstalling the phone or wiping it won't remove the hack.
Amazon cloud is prolly where the C2 servers and data are being hosted.