Except they have control of the phone and can intercept text and email alerts, if not with these exact vulnerabilities, it doesn't seem far fetched. And getting funds returned takes time while bills still have to be paid.
These folks may not want money, but the phone is vulnerable and the next set of folks may. Do you really think the crooks who commit identity theft and ransomware attacks aren't salivating at these attacks?
These folks don't want money.
And statue protects you from fraud - just set up text and email alerts so large transactions alert you ASAP.