No. SIM card is generally very small (32kb ~ 64kb) and stores only TLV records, which is not really suited for apk (though technically it can still be possible to store it as a binary record, but is technically very challenging).
Factory reset restores an image which is stored in a system partition on the phone, so if the spyware has somehow been able to successfully corrupt the factory image, then it would again be restored on factory reset. However, such modification can be done only when your phone is rooted (has
su binary) or when your bootloader is replaced by an infected bootloader (Most android phones have specific key sequence to be pressed in order to access bootloader, check xda forum for your phone model). Probably that is how malware is able to reinstate back on factory reset.