How do I remove spyware that gets past sandbox

As per the article App security overview - Apple Support

On iPhone, iPad and iPod touch, all apps are obtained from the App Store — and all apps are sandboxed — to provide the tightest controls.

You can erase the complete iPhone from iCloud Erase a device in Find My iPhone on iCloud.com - Apple Support

Erase iPhone - Apple Support

The best way is factory reset iPhone Restore your iPhone, iPad, or iPod to factory settings - Apple Support

If you ever had turned on iCloud features in iPhone Turn iCloud features on or off - Apple Support the data had already synced with iCloud , when you once again set up iPhone Set up your iPhone, iPad, or iPod touch - Apple Support and iCloud Set up iCloud on your iPhone, iPad, or iPod touch - Apple Support and sign in with same Apple ID and password on the network the data will start syncing .

Make sure you possess that iPhone .

Not possible. Without physical possession of your iPhone no hacker can do what you claim, period, end of story.

No. You don't. What you're proposing is simply not possible without gaining physical access to your phone along with the Lock Screen passcode and Apple ID and password.