From a forensics standpoint, is there any technical possibility that WITHOUT rooting the device the potential cybercriminal used a manipulated system phone app to have hidden functionalities like secret messaging, which he had modified via a third party hacker/developer?
There were custom phones which had these kinds of apps, but I'm wondering whether this is doable without making a custom ROM or rooting the device (because then the actor has full control).