An iPhone absolutely can be hacked. Statements here to the contrary are incorrect. Security attacks against iOS are a business, too. A profitable one.
That written, these attacks are more commonly password-based.
Re-used passwords are a common source of these attacks. Your email and password will be exposed in a server breach somewhere. Folks will then try that email and password everywhere else.
Another common path is phishing, fake messages and fake mail seeking to cause you to or to entice you into or to panic you into a log in on a fake portal or fake network service, and to expose your Apple ID. These are quite common. Big business, too.
More than a few folks here have yet to enable two-factor authentication, which makes these account take-over attacks easier.
There are other paths.
And yes, some can involve breaching iOS, though those attacks are rare and usually targeted.
If you’re associated with Microsoft as could be inferred here, absolutely work this through Microsoft security, as there re folks that do want to access the internal network and internal services of Microsoft. (But if you’re not somehow associated with Microsoft, I’d wonder if those conversations were not actually with Microsoft folks, but with folks seeking to socially engineering access.)
If you think your Apple ID has been compromised - Apple Support — reset your passwords to unique new passwords, and reset your passwords associated with email accounts that are associated with password reset requests, reset social media tokens and logins, and, well, unfortunately, pretty much everything with a password. Wresting back access after a breach is Not Fun. Also remove any VPN client apps and security apps that that you didn’t specifically add. (I’d likely wipe the iPhone and start over.)