There can be endless ways to spy on android devices or phones in general. Device intrusion is one way to get in and it may not be always effective because of hardened OS protections and malware detection. Spying in general depends upon possible attack vectors that can be used to discover your secrets. E.g. Your wifi traffic, internet activity, online accounts activity and calling can be used to fingerprint your behaviour about how you use your device. If they are state actors, anything outside of scope of your device can be monitored.
If it's something that only exist on your device like your chat history of e2ee messaging, offline contacts, password manager, media, etc., device intrusion can exfliltrate this data if the level of compromise is deep enough. It's not as straightforward as installing a spyware app because apps themselves don't have enough permissions to monitor everything on your device and installing a spyware app without the authorisation of the device owner is not possible without exploitating vulnerabilities in your device. "Unknown Sources" option requires device to be unlocked to authorise installation and the source of the installing app should be also authorised to prompt installation if the source is not a system app.
What type of vulnerabilities can be used to silently install spyware is outside of scope of this answer. The specific is chain of any high serverity vulnerabilities that can give enough privilege to the attacker to install and grant permissions to the spyware or inject malware into installed apps who already have permissions. Fileless malwares have been seen in the wild to compromise both android & iOS. E.g. NSO Group is known to compromise journalists' devices just by ringing through WhatsApp calling. Jeff Bezos received a WhatsApp message laden with code that secretly snatched reams of personal data from his iPhone X. Once the mole is in, it can also be used to try out new exploits through that window.
Permission to log keys, access media elements and read contents on your screen depend on type of compromise. E.g. If the spyware app has gained accessibility permission, it can record touch input and read anything on your screen. Also, it's not necessary that vulnerabilities will always work. SELinux blocks processes that violate SELinux policy. State agencies can even force OEMs to deliver compromised OS update that can grant root access to them.
But let's assume this is not the case and your device is fully updated and the attacker doesn't have zero days to compromise your device "remotely". With physical access on the device, bootloader is locked and the screen is locked, there's nothing much an attacker can do except for receiving calls and reading notifications. Though notifications can be helpful to take over accounts that uses SMS based 2FA. It won't work if the device owner has disabled notifications for locked screen or if the device has been rebooted but not unlocked.
There have been some ways discovered by spyware agencies to decrypt data on a locked device. If the device has been unlocked atleast once since last reboot, also known as After First Unlock (AFU) state, data encryption keys are made available to the kernel in memory. Using exploits that can work at locked screen, they are able to compromise kernel, steal the key and decrypt the data. It fails if the device has not been unlocked since last reboot, also know as Before First Unlock (BFU) state. This design flaw is being addressed by integrating Inline Crypto Engine in modern SoCs to store keys and with introduction of Rust to reduce these memory based attacks.
