For almost all questions asked "is it possible to hack" the answer is yes. There's questions of viability, cost, difficulty and so on, but there's rarely one scenario that is technically impossible. So instead of asking if some hack is possible, ask how likely it is.
In your case, someone close to your phone could in theory break into it without even connecting to your hotspot. As Steffen commented, Bluetooth and wifi code has had vulnerabilities that would enable an attacker in radio range to compromise the OS and execute commands.
Depending on the apps you have, an attacker could download files from your computer. For example, ES File Explorer had this vulnerability years ago:
The ES File Explorer File Manager application through 220.127.116.11.4 for Android allows remote attackers to read arbitrary files or execute applications via TCP port 59777 requests on the local Wi-Fi network. This TCP port remains open after the ES application has been launched once, and responds to unauthenticated application/json data over HTTP.
If you had the vulnerable version of ES File Explorer and had executed it at least once, anyone on your hotspot could download your files, upload files, execute apps, and install apps (if you gave ES File Explorer permission to install apps).
Android has a smaller attack surface than Windows desktop, but the surface exists. It's not possible to protect every single component, and it's not possible to prevent every single attack. Some attacks will depend on installed apps, others on the installed Android version, and others on the hardware itself. And if your handset is not receiving updates anymore, you will not even know if there's any vulnerability in it.
How likely is it that you got hacked? No idea. It depends on the skills of the friend using your hotspot, but I would say that, in general, the risks are pretty low.