The phone-shop detail is the most alarming part for anyone at risk there: a device compromised before you even switch it on defeats most of the usual advice. For journalists and activists in that position, the practical baseline is buying devices from a large retailer or outside the country rather than a local shop, keeping the OS fully updated, and on iPhone turning on Lockdown Mode, which was built for exactly this kind of targeting.
Amnesty's Security Lab also maintains the open-source Mobile Verification Toolkit (MVT) for checking phones, and Access Now runs a free digital security helpline for civil society if someone suspects they've been targeted.