I assume that by saying spy apps you are talking about a specific type of paid apps,
Well even those not paid apps or even self developed ones can spy in your phone die to the fact the your phone is generally not protected by Anti-virus solution, so any amateur can create his own remote access Trojan and spy on you.

Now, how can someone install this rat in your phone ?


Physically : in 2 minutes he can disable Google play protect, and download and install his rat

Remotely : Via social engineering techniques (such as spear phishing )
or via an advanced technique called Zero-click attack, (no-offense don't worry about this technique)