While malware does exist for iPhone, it is rare and targeted based on available evidence, and the associated exploits exceedingly valuable.
You are alleging a criminal act by a specific person, and will want to discuss your purported evidence directly with legal counsel. That potentially as part of a legal proceeding.
Developer access does not bypass the in-built security and related features of Apple iOS, though it bypass the app store path used for loading apps. When not in developer mode, any such added apps don’t work. Your devices would obviously not be in developer mode, of course.
More common exploits are unrelated to an iPhone, such as a compromised Apple ID, an added trusted device, a compromised carrier account, lack of two-factor, poor password choices, nefarious hardware, or otherwise.
After discussion with counsel, maybe: https://www.lockdownyourlife.com/
Review the following, and run Safety Check: Personal Safety User Guide - Apple Support