I'm not an expert either so I can only give generalities.
Installing a spyware remotely is likely much harder than with physical access to the phone. In the latter case, you're totally screwed : physical access is total access.
If the phone is away, the only option would be to break into it, using an OS vulnerability. It's totally possible as no system is totally secure, but these usually require an action from the user, therefore good security practices will most likely prevent this.
Namely, ignore any link or attachment coming from emails, or unknown or obviously hacked phone numbers/social media accounts/messaging service accounts : these can try to exploit vulnerabilities in your browser or in other parts of the OS.
Emails are easy to spoof, SMS likely harder, but I wouldn't trust them either ; social medias are usually better secured but client vulnerabilities, weak passwords or social engineering can allow someone to break into accounts anyway. Therefore, if you have a doubt, stay safe.
A more worrying problem is the lack of software updates. Most Android phones have outdated Android versions because the manufacturer doesn't care. You don't have a lot of options here : choose a model that's regularly updated like Google's Nexus/Pixel lines, or use an iPhone, as Apple typically updates its devices pretty quickly and supports them for years.
Also, forget jailbreaking, and stick to well-known apps in Google's or Apple's application stores. These are well reviewed and very likely not malicious.
TL;DR It's possible and been seen before, but usually requires user mistakes, and good practices can likely prevent it.