Is there non-malware that can just run without user interaction? In that case, yes, if the malware can trick your device into believing that it is non-malware.
For example, Apple can automatically update your iPhone system software if you allow it. A hacker can send you something that looks superficially like a software update, close enough for your phone to examine it. If you managed to create a package that convinced your iPhone that it is a genuine software update then the code would automatically be run. (There’s probably nothing on iOS or android devices that is better protected, so this is not going to happen).
On iOS applications can register for url schemes. So links that don’t start with http:// or https:// but with gnasher:// for example could be sent to an app on your phone that I have written. If your browser decided to do that automatically (which it shouldn’t) then the url would be sent to my app without further user interaction. I’d consider that a major vulnerability in the browser. But then if there are major vulnerabilities then things go wrong.