It isn't difficult to contrive possibilities even in the case of using practices for an iDevice (such as for the screenshot: find incriminating picture [somewhere] -> search for picture hash -> find out that Aude has that same picture on his phone even though it is using iCloud Advanced Data Protection).

The real interest is in the explanation they give and if it is plausible or if it seems to be parallel construction to cover pushing out specialized signed software to employee phones to detect this.