Wasn't this already a thing waiting to happen with usb-pd? What's there to prevent a pwned phone from requesting too much voltage from a charger?
Also, the cable doesn’t care about voltage. You can use literally any cable to provide 20V just fine.
This would require malware on the phone itself, though. Possibly something quite low level.