https://www.heise.de/news/BKA-nutzt-WhatsApp-Webfunktion-zum... (German) says they had physical access to the device and likely simply logged in to WhatsApp web in a browser. There's an always active notification indicating your account is used on the web but apparently that's easily circumvented by disabling a notification category, leaving the suspect to specifically go somewhere in the app to notice.